Many packages suddenly disappeared • Hacker News Board

Re: Many packages suddenly disappeared

#281

Post by rabidrat » Sat, Jan 06, 2018, 10:56 PM UTC

nawgszy wrote: post #256

none_to_remain wrote: post #233

Earlier quoted context omitted.

At my job we do native C and C++, some Java, some C#, scripting in Shell, Python, and Perl. When the left-pad incident happened someone said something to the room about it, we all looked it up, and spent a good 15 minutes mind-boggled, laughing and being grateful we weren't web devs. "Wait, you're telling me these people need NPM and GitHub to deploy? Seriously?"

>these people need [their package manager] and [their source code management tool] to deploy? Seriously? Not really sure I understand what you're implying there

A public package manager and a public source code management tool, both of which are outside of your control. You should be able to deploy from a local [verified and audited] cache of your dependencies.

Re: Many packages suddenly disappeared

#282

Post by thsowers » Sat, Jan 06, 2018, 10:57 PM UTC

seldo wrote: post #268

Hi folks, npm COO here. This was an operational issue that we worked to correct. All packages are now restored: https://status.npmjs.org/incidents/41zfb8qpvrdj

Any chance of a technical write-up so that we can all learn from whatever happened?

Re: Many packages suddenly disappeared

#283

Post by scottmf » Sat, Jan 06, 2018, 10:57 PM UTC

feduzi wrote: post #244

I don't get why not just use git repo registry (e.g. github) for package management. If you work in a "strict" environment you can basically fork all your dependencies and use your own git repo registry. NPM already allows using git repos, but needs some tweaks to allow better support: * allow versioning via git tags * store git commit in `package-lock.json`. * maybe something else...

What would you gain by storing the commit in the lock file?

You can reference commits in package.json already.

Re: Many packages suddenly disappeared

#284

Post by borntyping » Sat, Jan 06, 2018, 10:57 PM UTC

notatoad wrote: post #106

lioeters wrote: post #89

Earlier quoted context omitted.

As a counterpoint, couldn't any sufficiently complex structure be called a hack and a house of cards, when you really dig down into how it's put together? Mm, maybe not any - as some complex systems are well-tested with solid architecture - but just some, or most..

A "house of cards" implies that you don't have to dig to topple it. If you have to really dig down into how it's put together in order to start pulling it apart it isn't really a house of cards. I don't use npm or node for anything serious, and i don't really have any knowledge of how NPM works, but this isn't the first time i've read this story of a whole bunch of packages disappearing and everybody's builds breakin…

> If everything is a house of cards, then why don't i hear the same stories about PyPI or gems or crates?

npm is roughly twice as big as PyPI, RubyGems and crates.io together.

Re: Many packages suddenly disappeared

#285

Post by corndoge » Sat, Jan 06, 2018, 10:59 PM UTC

nukeop wrote: post #32

NPM is extremely vulnerable to typosquatting. Be cautious with what you install. The install scripts can execute arbitrary code. NPM's team response is that they hope that malicious actor won't exploit this behaviour. According to my tests, typosquatting 3 popular packages allows to take over around 200 computers in 2 weeks time it takes their moderators to notice it.

typical JavaScript engineering

Re: Many packages suddenly disappeared

#286

Post by lotyrin » Sat, Jan 06, 2018, 10:59 PM UTC

krzyk wrote: post #26

So they didn't learn anything from left-pad situation from 1.5 year ago? Packages that are published should be immutable, just like in maven repo case.

I don't really understand any public package repository that fails to have immutable package versions and publisher-namespaced package names.

Re: Many packages suddenly disappeared

#287

Post by Moter8 » Sat, Jan 06, 2018, 11:00 PM UTC

Could we have a better title perhaps, giving at least "[npm]" or something as a hint?

Re: Many packages suddenly disappeared

#288

Post by MaxLeiter » Sat, Jan 06, 2018, 11:00 PM UTC

Couldn’t this be solved in the future by npm storing packages with user names? I.e. “MaxLeiter/example” instead of “example”

Re: Many packages suddenly disappeared

#289

Post by kcolford » Sat, Jan 06, 2018, 11:00 PM UTC

dmitriid wrote: post #172

maxander wrote: post #121

Earlier quoted context omitted.

And all this is happening just as after the public release of a serious exploit which allows malicious code to do all sorts of nefarious things when it is somehow installed on the target machine . Hmm. Given that there's hints, at least, that the problems were caused by some particular developer's actions, I wonder about the security model for package-managed platforms altogether now. If I were a big cybercrime ring,…

On top of that, they way countless packages are used everywhere is potentially exploitable: https://medium.com/@david.gilbertson/im-harvesting-credit-ca...

That's actually even more scary than what's going on now... At least most of us are noticing and can check what's going on...

Re: Many packages suddenly disappeared

#290

Post by clon » Sat, Jan 06, 2018, 11:03 PM UTC

0x0 wrote: post #215

ben_jones wrote: post #127

module.exports = typeof Promise === 'function' ? Promise : require('pinkie'); I can't even install webpack-dev-server. Because this package is missing. EDIT: it's back [1]: https://stackoverflow.com/questions/48131550/nodemon-install... [2]: https://github.com/npm/registry/issues/255

But it's published by "puradox", not by "floatdrop"!

This is utter madness...