Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious code in the purescript NPM installer

harry.garrood.me

Post reply on HN
Print view View original

211–220 of 279 posts

Re: Malicious code in the purescript NPM installer

#211

Post by inimino »

ricardobeat wrote: post #98
SCLeo wrote: post #81

Earlier quoted context omitted.

I honestly don't understand why people use packages like this. If I need this functionality, I will simply write my own. Plus, I will never able to find this specific package. I guess PureScript uses this because its author is also the author of rate-map.

I’ll give you one: it’s code already written and tested by > 1 person, edge cases already figured out. Saves you time. The gains are small but quickly add up. This is why lately I’ve been a fan of very extensive standard libraries (like Crystal has) - its like having a huge repository but vetoed by the same team and without any of the package management drawbacks.

[C]ode already written and tested by > 1 person, edge cases already figured out wastes time when that person was not you. This costs you time. The losses are small but they add up.

Re: Malicious code in the purescript NPM installer

#212

Post by littlestymaar »

twic wrote: post #207
munificent wrote: post #151

Earlier quoted context omitted.

> It's just infinitely, obviously better. Whenever a large number of skilled people do something for which an alternative is "infinitely, obviously better", there's a good chance that there is more going on than you know. RubyGems used to be namespaced this way and moved away from it. They didn't do so lightly. The problem is that ownership, and even names of owners change all the time . In the very very large majori…

> a large number of skilled people > RubyGems Well, which is it? Java has used namespaced packages since 1996, and it's been a roaring success. There have certainly been problems - for example, there is currently some absolute nonsense going on about the handover of big chunk of stuff from Oracle to the Eclipse Foundation [1] - but they have always been manageable, and don't come close to outweighing the benefits. [1…

Java was indeed a success, but its dependency management is archaic at best. Yes it's better than FORTRAN or C, but I wouldn't use it as a reference in 2019…

Re: Malicious code in the purescript NPM installer

#213

Post by inimino »

dmitriid wrote: post #154
SCLeo wrote: post #81

Earlier quoted context omitted.

I honestly don't understand why people use packages like this. If I need this functionality, I will simply write my own. Plus, I will never able to find this specific package. I guess PureScript uses this because its author is also the author of rate-map.

Funnily enough, in my opinion, the JS ecosystem fully embraced the Unix way: have small programs/libs that do only one thing and do it (somewhat) well.

No, they do not on the whole do anything well.

Re: Malicious code in the purescript NPM installer

#214

Post by inimino »

fock wrote: post #184
krainboltgreene wrote: post #45

Earlier quoted context omitted.

Please list the group of people you trust to manage 1,037,274 packages.

Tell me, why one needs packages such as this except for personal (and ultimately npm) marketing: https://github.com/sindresorhus/shebang-regex - the whole thing smells

You're being downvoted because that is mean-spirited, but the reason we needed these packages is to find out what the right size of package is. We now have a lower bound.

Re: Malicious code in the purescript NPM installer

#215

Post by vhakulinen »

hu3 wrote: post #191
fock wrote: post #187

Earlier quoted context omitted.

well, the rate-map at least includes a function: https://github.com/sindresorhus/shebang-regex

A dependency for /^#!(.*)/; With 8.6 mil downloads and 71 dependents... https://www.npmjs.com/package/shebang-regex

This just made my day.

Re: Malicious code in the purescript NPM installer

#216

Post by littlestymaar »

davnicwil wrote: post #192
munificent wrote: post #151

Earlier quoted context omitted.

> It's just infinitely, obviously better. Whenever a large number of skilled people do something for which an alternative is "infinitely, obviously better", there's a good chance that there is more going on than you know. RubyGems used to be namespaced this way and moved away from it. They didn't do so lightly. The problem is that ownership, and even names of owners change all the time . In the very very large majori…

When package owners change, or change names, would the original package namespace still stick around for all the existing versions? Also, would there be a pointer built in that let you know about the new owner namespace when you try to upgrade automatically? If so, I really don't see the practical problem. Actually it seems like useful information. If I'm upgrading and the package owner changed, that's definitely som…

> Also, would there be a pointer built in that let you know about the new owner namespace when you try to upgrade automatically?

And what would be the point of the namespace then ?

Re: Malicious code in the purescript NPM installer

#217

Post by kkapelon »

allover wrote: post #33
Fellshard wrote: post #20

Earlier quoted context omitted.

Mostly because the vast majority of JS developers don't seem to be aware of the rest of the software universe, and so seem to reinvent the wheel, rediscover the worst of software's history, and discard the most useful of software findings with shocking regularity. NPM tends to reinforce the worst of the JS world's tendencies.

> Mostly because the vast majority of JS developers don't seem to be aware of the rest of the software universe Do you have any evidence to back up this statement, compared to developers in other languages? Or is this just business-as-usual JS bashing?

I cannot talk for all other languages but at least in Java

1)All packages that are published can never be unpublished or re-released from a different contributor

2)Packages are namespaced

3)Nobody downloads packages directly from the internet. You always use a proxy which in most companies has security scans.

4)There are no "local packages" (like the node_modules dir), so it is impossible for the checked out source code to override your own vetted and secure package.

Not directly related to the incident of the original post, but I was mindblown when I realized that you can unpublish npm packages

Re: Malicious code in the purescript NPM installer

#218

Post by kkapelon »

littlestymaar wrote: post #212
twic wrote: post #207

Earlier quoted context omitted.

> a large number of skilled people > RubyGems Well, which is it? Java has used namespaced packages since 1996, and it's been a roaring success. There have certainly been problems - for example, there is currently some absolute nonsense going on about the handover of big chunk of stuff from Oracle to the Eclipse Foundation [1] - but they have always been manageable, and don't come close to outweighing the benefits. [1…

Java was indeed a success, but its dependency management is archaic at best. Yes it's better than FORTRAN or C, but I wouldn't use it as a reference in 2019…

what would you use instead as a reference?

Re: Malicious code in the purescript NPM installer

#219

Post by davnicwil »

littlestymaar wrote: post #216
davnicwil wrote: post #192

Earlier quoted context omitted.

When package owners change, or change names, would the original package namespace still stick around for all the existing versions? Also, would there be a pointer built in that let you know about the new owner namespace when you try to upgrade automatically? If so, I really don't see the practical problem. Actually it seems like useful information. If I'm upgrading and the package owner changed, that's definitely som…

> Also, would there be a pointer built in that let you know about the new owner namespace when you try to upgrade automatically? And what would be the point of the namespace then ?

> pkg upgrade @person-a/some-package

"You're on the latest version 1.2.3 of @package-a/some-package, however @person-a has officially transferred ownership of some-package to @person-b and there is a newer version 1.2.4 available at @person-b/some-package. If you'd like to upgrade, please update your dependency to @person-b/some-package"

Re: Malicious code in the purescript NPM installer

#220

Post by rjmunro »

delfaras wrote: post #178
reeeeee wrote: post #175

Earlier quoted context omitted.

There is not even a link to the source code on the npm page for it. I installed it and inspected the source code, but I doubt everyone does this when installing a dependency.

Here's the complete source for anyone curious ``` exports = module.exports = trim; function trim(str){ return str.replace(/^\s |\s $/g, ''); } exports.left = function(str){ return str.replace(/^\s /, ''); }; exports.right = function(str){ return str.replace(/\s $/, ''); }; ```

That code doesn't match what actually happens. It will only trim a single character. Have asterisks been trimmed in your copy-paste or something?
Post reply on HN