Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many packages suddenly disappeared

github.com

Post reply on HN
Print view View original

311–320 of 520 posts

Re: Many packages suddenly disappeared

#311

Post by Silhouette »

jogjayr wrote: post #305
Silhouette wrote: post #279

Earlier quoted context omitted.

Stop pointing your package managers to the public registry. Unfortunately with NPM this is still awkward, because as soon as you try to shrinkwrap your project, it doesn't just pin the version numbers, it also pins the full source location. That's in direct conflict with (and apparently takes precedence over) using one of the local caching proxies that would otherwise be a useful practical solution to this problem, a…

Don't use shrinkwrap - this comes directly from Laurie Voss, COO of NPM Inc. In my own experience using npm shrinkwrap has been pretty bad. NPM has its own lockfiles now, similar to yarn. > It has a few problems of its own, notably surprising, quiet updates to the lock file when using the default options This I've never noticed. I'm genuinely curious how it would happen. The only way I imagine it might happen is if y…

Some of its commands, notably install, can modify yarn.lock if it's out of sync with package.json, and I think that by default they still do so silently. You can override that modification with various options, but it seems to defeat the point of a tool whose main function is to ensure stable, repeatable builds if something on say your CI server or a developer's machine after a source control merge can wind up with a locally modified yarn.lock that doesn't fetch identical versions of all dependencies to what everyone else is using.

Edit: Also thanks for the tip about npm's new locking mechanism. Apparently that arrived with NPM 5. I just checked, and we have developer machines here that were last updated well under a year ago and are still on NPM 3, and that had itself been installed along with something like the third new major version of Node in not much over a year. I don't know how anyone is supposed to do development intelligently while the most fundamental tools for things like dependency management are bumping a major version and radically changing how they do even the most basic and essential things literally every few months. :-(

Re: Many packages suddenly disappeared

#313

Post by sillysaurus3 »

seldo wrote: post #291
thsowers wrote: post #282

Earlier quoted context omitted.

Any chance of a technical write-up so that we can all learn from whatever happened?

Absofuckinglutely. It's being done as we speak.

Ha, thanks for speaking plainly. It's so refreshing.

Sometimes a fuckbomb is the best way. Rarely and tastefully, but still.

Re: Many packages suddenly disappeared

#315

Post by amiga-workbench »

jimjimjim wrote: post #185

I said this back in the left pad days Store all of your dependencies locally. If something disappears then at least you can continue until you find a replacement.

We do this with all of our PHP dependencies at work, they get committed into the project. The upside is that the deployment process is simpler, the server doesn't have to fetch all the libraries you depend on within each deploy and it mitigates all of the risk of left-pad style bullshit.

Re: Many packages suddenly disappeared

#316

Post by bubble_boi »

marpstar wrote: post #147
weinzierl wrote: post #69

Earlier quoted context omitted.

Detailed description what you could do with a malicious npm package is currently on he front page: "Harvesting credit card numbers and passwords from websites" https://news.ycombinator.com/item?id=16084575

am I the only one who thinks this could be more than a coincidence?

Hey, I wrote that article :) - yes it was pure coincidence, I just decided with all the security stuff going on this week (Spectre/Meltdown, I hadn't heard about the npm stuff) I'd write and article about it.

Re: Many packages suddenly disappeared

#317

Post by 0x0 »

The status page at https://status.npmjs.org/incidents/41zfb8qpvrdj says that "We apologize for the temporary unavailability of some packages.".

If this was only a matter of missing packages, this would "only" be a matter of breaking builds.

But it looks like third parties were able to take over the missing packages, see https://github.com/npm/registry/issues/256 - which is a HUGE deal, considering "npm install" blindly executes the scripts in a package's preinstall property (as well as the packaged module itself possibly containing arbitrary backdoors)

Re: Many packages suddenly disappeared

#318

Post by MagicWishMonkey »

maxander wrote: post #121
racbart wrote: post #5

PSA: Please be cautious because this is an excellent opportunity for taking over packages and injecting malware by malicious people. Example: https://www.npmjs.com/package/duplexer3 which has 4M monthly downloads just reappeared, published by a fresh npm user. They published another two versions since then, so it's possible they've initially republished unchanged package, but now are messing with the code. Previously…

And all this is happening just as after the public release of a serious exploit which allows malicious code to do all sorts of nefarious things when it is somehow installed on the target machine . Hmm. Given that there's hints, at least, that the problems were caused by some particular developer's actions, I wonder about the security model for package-managed platforms altogether now. If I were a big cybercrime ring,…

Wouldn't you need to install those packages as root for the code to have privileges to take advantage of that exploit?
Post reply on HN