Tell HN: Node.js koa-router package transferred to unknown user
1–10 of 48 posts
Re: Tell HN: Node.js koa-router package transferred to unknown user
#2Is NPM at it again?
Re: Tell HN: Node.js koa-router package transferred to unknown user
#3The npm package ownership process is flawed. Anecdotally, I received an email from npm support saying someone requested publish rights to a package that I manage. The default was that the access would be granted if I did not respond within 30 days.
It's very possible this went through npm support, they received no reply within the window, and the transfer was granted.
There are good practices around domain names to lock transfer, perhaps npm should consider adopting similar mechanisms.
--edit-- for the curious, here is the redacted email chain. I don't want to call anyone out on this. These things are hard and handling edge cases are very difficult. I love npm, and host several packages there. I really appreciate everything they've done for node and javascript, and I think folks are harder on them than they should be due to some tricky decisions they've made. But I want things to improve for everyone, so consider this a disclosure for analysis on how things can get better. https://pastebin.com/636v8YSP
Re: Tell HN: Node.js koa-router package transferred to unknown user
#4The npm package ownership process is flawed. Anecdotally, I received an email from npm support saying someone requested publish rights to a package that I manage. The default was that the access would be granted if I did not respond within 30 days. It's very possible this went through npm support, they received no reply within the window, and the transfer was granted. There are good practices around domain names to l…
[deleted]
Re: Tell HN: Node.js koa-router package transferred to unknown user
#5Is NPM at it again?
I don't think NPM themselves have done much here. The original owner of the module sold(!) the package name and transferred it to a new owner. It's not like this was somehow sneakily stolen.
Re: Tell HN: Node.js koa-router package transferred to unknown user
#6The npm package ownership process is flawed. Anecdotally, I received an email from npm support saying someone requested publish rights to a package that I manage. The default was that the access would be granted if I did not respond within 30 days. It's very possible this went through npm support, they received no reply within the window, and the transfer was granted. There are good practices around domain names to l…
What a strange exchange. Why would npm assume that you actually want to add this random third party as a user? Could the package in question have appeared "dead" (i.e. no recent updates, not many weekly downloads)?
Re: Tell HN: Node.js koa-router package transferred to unknown user
#7Is NPM at it again?
I don't think NPM themselves have done much here. The original owner of the module sold(!) the package name and transferred it to a new owner. It's not like this was somehow sneakily stolen.
I agree on them not doing much. As in not much at all to help. How about I just go ask for every package on NPM and see who's busy enough to deal with that or not?
I love Javascript but the ecosystem stinks.
Re: Tell HN: Node.js koa-router package transferred to unknown user
#8thats actually a kind of cool attack vector.
Re: Tell HN: Node.js koa-router package transferred to unknown user
#9To anyone reading this, I'm building a tool to automate this nonsense, at least until Node/NPM do something about it. Email me at niftylettuce@gmail.com if you want to get notified once it's up. It will be free and open-source.
Re: Tell HN: Node.js koa-router package transferred to unknown user
#10To anyone reading this, I'm building a tool to automate this nonsense, at least until Node/NPM do something about it. Email me at niftylettuce@gmail.com if you want to get notified once it's up. It will be free and open-source.
>automate this nonsense
What exactly are you automating? A notification system for transferring of ownership?