Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

71–80 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#71

Post by temp12192021 »

MaxBarraclough wrote: post #45
rajin444 wrote: post #28

Earlier quoted context omitted.

There’s no reason people can’t keep local caches of these libs if it is a major concern. This seems like a non issue.

Stale libraries are more likely to contain known security vulnerabilities.

I know it's bad practice, but I just checkin vendor files/libs to source control. Makes auditing new releases of libraries a bit easier. Assuming they aren't binaries of course.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#74

Post by Osmose »

It's a bit wild that the sum total money spent on salaries for engineers handling potential problems stemming from this or defending against the possibility in the future could probably have covered paying the maintainer a living wage many times over.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#75

Post by jtvjan »

capableweb wrote: post #42
detaro wrote: post #39

Earlier quoted context omitted.

Introducing a deliberate endless loop is not like changing the API of a library, no.

But if the API offered a function called .countBy but then renamed that function to be .countAllBy, now I can't run my application anymore, causing my service to go down if I upgrade the version without testing it, is that a DoS now?

NPM expects packages to follow semantic versioning. If a package contained a breaking change like that, there would be a major version bump, and you'd have to upgrade manually.

If the maintainers wasn't acting maliciously, they could change this new version to count as a major release, and then it wouldn't be a DoS.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#77

Post by Xylakant »

bcrl wrote: post #55

At some point people need to stop pulling in random unsigned libraries from the internet and deploying them without any review or testing. This chaos seems like it would be entirely preventable with just a small sprinkling of best practices.

Signing would not have helped at all here - the author decided to nuke their project (and likely their last reputation), they could have signed that commit/package.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#79

Post by laurowyn »

ruuda wrote: post #47

This is why you pin all dependencies and upgrade (and test) when it's convenient for _you_, not when the author pushes a new version.

Pin all you want, if the repo/vendor/maintainer pulls the release then you're not getting access to your dependencies at all.

If anything, this is the reason you use pull-through proxies. Your proxy will hold the version you depend on, regardless of upstream drama. Keep your proxy backed up and you'll be able to use those dependencies until the end of time, or you finally decide to migrate to an alternative.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#80

Post by fault1 »

hartator wrote: post #46

Anyone knows what the author meant by the "LIBERTY LIBERTY LIBERTY" message? It's unclear if it's referring to current authoritarian turns in our western world, big corps using his software for free, or something else.

The author of this package was caught with 50lbs of Potassium Nitrate (in the middle of NYC) and a bunch of materials on making bombs and booby traps when his apartment caught fire:

https://abc7ny.com/suspicious-package-queens-astoria-fire/64...

https://www.qgazette.com/articles/more-charges-possible-for-...

https://nypost.com/2020/09/16/resident-of-nyc-home-with-susp...

He might have been the unibomber in training.

Don't want to pile on, but dude clearly seems to be going through mental issues.

Post reply on HN