Maybe transfer of ownership should be a mandatory major version bump with no option to release to lower major versions anymore.
Tell HN: Node.js koa-router package transferred to unknown user
11–20 of 48 posts
Re: Tell HN: Node.js koa-router package transferred to unknown user
#12koa-router was owned by @alexmingoia and not by @koajs. Still it is a central piece of the koa framework that compromises practically every koa setup. The only alternative I have found is this:
https://github.com/koajs/trie-router
The transition from express to koa has been slow, and this doesn't help. It will undermine the confidence on the koa framework.
Re: Tell HN: Node.js koa-router package transferred to unknown user
#13Earlier quoted context omitted.
I don't think NPM themselves have done much here. The original owner of the module sold(!) the package name and transferred it to a new owner. It's not like this was somehow sneakily stolen.
I agree on them not doing much. As in not much at all to help. How about I just go ask for every package on NPM and see who's busy enough to deal with that or not? I love Javascript but the ecosystem stinks.
Could you not do that on PyPi and rubygems as well?
Re: Tell HN: Node.js koa-router package transferred to unknown user
#14The npm package ownership process is flawed. Anecdotally, I received an email from npm support saying someone requested publish rights to a package that I manage. The default was that the access would be granted if I did not respond within 30 days. It's very possible this went through npm support, they received no reply within the window, and the transfer was granted. There are good practices around domain names to l…
I've been on the other side of a similar conversation, that eventually got me the name I wanted after around 30 days. This was around five years ago, when there were still no scoped packages and the ecosystem was surging in popularity. I guess in the previous years people had been creating test packages and forgetting about them, and no doubt some were just squatting popular names. In my case the package with the name I wanted was empty and inactive, and there was a human check before it being handed over.
Re: Tell HN: Node.js koa-router package transferred to unknown user
#15The npm package ownership process is flawed. Anecdotally, I received an email from npm support saying someone requested publish rights to a package that I manage. The default was that the access would be granted if I did not respond within 30 days. It's very possible this went through npm support, they received no reply within the window, and the transfer was granted. There are good practices around domain names to l…
What a strange exchange. Why would npm assume that you actually want to add this random third party as a user? Could the package in question have appeared "dead" (i.e. no recent updates, not many weekly downloads)?
It wasn't dead, but I hadn't updated it in awhile and it wasn't the most popular thing in the world.
Re: Tell HN: Node.js koa-router package transferred to unknown user
#16Although nothing malicious has happened yet, that change in the readme ("this package name is for sale") is spammy and concerning. Kudos on niftylettuce (love your blog!) for raising awareness.
This is yet another example of a (by now fairly known) vulnerability in the npm package ownership transfer process. Just a few months ago, there was a big drama with malicious code found in a popular package `event-stream`, placed by a new unknown owner.
I like one of the ideas in the GitHub issue, that a change in package ownership should be considered a major semver bump. At least that might reduce the reach of a bad actor who would buy a popular package for exploitation.
Re: Tell HN: Node.js koa-router package transferred to unknown user
#17The npm package ownership process is flawed. Anecdotally, I received an email from npm support saying someone requested publish rights to a package that I manage. The default was that the access would be granted if I did not respond within 30 days. It's very possible this went through npm support, they received no reply within the window, and the transfer was granted. There are good practices around domain names to l…
I've been on the other side of a similar conversation, that eventually got me the name I wanted after around 30 days. This was around five years ago, when there were still no scoped packages and the ecosystem was surging in popularity. I guess in the previous years people had been creating test packages and forgetting about them, and no doubt some were just squatting popular names. In my case the package with the nam…
Yes I had guessed the policy is to prevent squatting. But it shouldn't apply to packages that actually have code sitting in them - anyone could have seen my package had a bunch of work gone into it, even if it hadn't been updated in a while. If it's a legit package, no matter how old it is, then the ownership should stick to the original author by default in perpetuity.
Re: Tell HN: Node.js koa-router package transferred to unknown user
#18Maybe transfer of ownership should be a mandatory major version bump with no option to release to lower major versions anymore.
Transfer of ownership can be done "unofficially" in many ways though, for instance adding a contributor to the organization which controls the package. Requiring a major bump could be problematic in many cases (I'm thinking, @microsoft adding a member to their team would require a major for all their packages). And one can always sell their entire npm account, and no-one would notice.
Re: Tell HN: Node.js koa-router package transferred to unknown user
#19Earlier quoted context omitted.
I don't think NPM themselves have done much here. The original owner of the module sold(!) the package name and transferred it to a new owner. It's not like this was somehow sneakily stolen.
I agree on them not doing much. As in not much at all to help. How about I just go ask for every package on NPM and see who's busy enough to deal with that or not? I love Javascript but the ecosystem stinks.
Yeah, it's unfortunate that the entire Javascript ecosystem is inextricably wedded to a single company's registry and package manager but what can you do? We all just have to put up with it, I guess.
Re: Tell HN: Node.js koa-router package transferred to unknown user
#20Please stop harassing me. Let's set the record straight.
The Koa organization did not write, maintain, or ever help with this package. I wrote it. I maintained it, with help from people who reached out to me directly (and actually contributed code).
@ZijianHe offered to maintain it, and I agreed to let him maintain it. Our relationship is not anyone's business. I don't have a relationship to the koa organization. I don't know them. Furthermore, @niftylettuce has repeatedly in emails to npm asserted that ZijianHe is Chinese, despite this having nothing to do with anything, or even knowing whether ZijianHe lives in China. Chinese developers have contributed more to this repository than anyone from the Koa organization. This kind of racial scaremongering or guilt by association is not acceptable. Its offensive. Let's be very clear: Developers from any ethnicity and nationality are welcome to contribute to open source.
I'm not going to say anything more on this issue. This is beyond ridiculous.