Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

141–150 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#141

Post by msoad »

I do free work for open source _a lot_. I have a rather controversial opinion on this. I don't think I should be paid for my work because the moment money comes in I have to be responsible for the work I was doing for fun. I enjoy building cool things others can use for free and I want to reserve the right to respond to feature requests with a simple "PRs are welcome! :)".

I get my paycheck from my employer and I have always been successful convincing my employers that I do open source work on the side for my own interest.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#142

Post by david_allison »

wbl wrote: post #92
mjlawson wrote: post #58

Earlier quoted context omitted.

This is true for npm. After the incident with leftpad, you can't unpublish anymore. You can, however, publish a new patch update that completely breaks everything.

Why does a new version break projects without action by the project owners? In Go you would have to explicitly update to the broken version.

*I revoke my comment. Child comment is correct.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#143

Post by apetresc »

cerved wrote: post #99
rich_sasha wrote: post #35

Earlier quoted context omitted.

In practical terms, can they really be audited? This is at least obvious DoS, I’m sure it’s easy to slip in an innocuous line that, dunno, ships your ssh keys to some rando server.

look at diffs?

Can you really say, with a straight face, that you inspect the diffs of your entire dependency closure every time you deploy an update? With the level of scrutiny required to detect a maliciously-obfuscated security exploit?

If you can, you're an infinitely more diligent developer than I am, that's for sure.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#144

Post by dane-pgp »

throw_m239339 wrote: post #83
mjlawson wrote: post #58

Earlier quoted context omitted.

This is true for npm. After the incident with leftpad, you can't unpublish anymore. You can, however, publish a new patch update that completely breaks everything.

> This is true for npm. After the incident with leftpad, you can't unpublish anymore. You can, however, publish a new patch update that completely breaks everything. You absolutely can unpublish, it just requires more steps. If NPM gets a DMCA takedown request they will absolutely have to fulfill it.

> If NPM gets a DMCA takedown request they will absolutely have to fulfill it.

Assuming the package is released under a Free Software licence, what grounds would there be for a DMCA takedown?

I suppose a developer could include the lyrics to a pop song in their code (possibly encrypted), and then tell the copyright holder about it (since I don't think you can make a DMCA request on behalf of a copyright holder without their permission), but I would hope that such a poison-pill would be caught long before the package became widely depended on.

Perhaps you're thinking someone would risk perjury(?) charges for making a false DMCA request against their package, and NPM would act on the request without questioning it; but remember that NPM is owned by Microsoft and they have previously stood up to frivolous DMCA requests (after a fashion)[0]. That article has the lede: "Software warehouse also pledges to review claims better, $1m defense fund for open-source coders".

[0] https://www.theregister.com/2020/11/16/github_restores_youtu...

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#145

Post by cerved »

notatoad wrote: post #88

i would pay for a service that runs an NPM mirror of a "last known good" version of packages to avoid this kind of thing. just keep all my dependencies a few weeks behind NPM to give things like this a chance to get caught, and let me continue blindly updating. every time something like this happens, the reaction in the comments is the same: well you should test your dependencies. and yeah, i do that before release,…

You're using a VCS I presume? Why not just rollback?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#146

Post by mschuster91 »

throw_m239339 wrote: post #126
dathinab wrote: post #103

Earlier quoted context omitted.

Except if they have reason to believe the code was uploaded with the permission of the copyright holder. The they have gotten the right for npm to distribute the source code in context of npm.

> The they have gotten the right for npm to distribute the source code in context of npm. There is absolutely no copyright or publishing right transfer that takes place when one "publishes" a package on NPM (or on Github). None. The original author is absolutely entitled to a DMCA takedown notice and NPM would have to oblige him.

You can't legally retract opening up software source code under most if not all popular open source licenses.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#147

Post by temp12192021 »

cerved wrote: post #111
temp12192021 wrote: post #71

Earlier quoted context omitted.

I know it's bad practice, but I just checkin vendor files/libs to source control. Makes auditing new releases of libraries a bit easier. Assuming they aren't binaries of course.

I don't recommend this approach

I haven't had issues yet, but it's considered bad practice for a reason. What headaches am I in store for?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#148

Post by throwawayay02 »

ulimn wrote: post #11
esarbe wrote: post #9

It's his software and he can do with it as he pleases. It's an MIT license, so there's no warranty whatsoever. I'm not convinced that GitHub has any business suspending his account.

If he can do as he pleases, can't GitHub as well?

They can and they did, but it still feels malicious because they intentionally reverted the maintainer's latest version, which is the author's will on their creation.

It's a bit like me going to my bank to close the account and instead they throw me out and keep my money.

Honestly I don't understand why microsoft did anything at all. Can't people just pin a version?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#149

Post by superkuh »

joshuaissac wrote: post #117

GitHub has now suspended the maintainer: https://nitter.net/marak/status/1479200803948830724

I don't understand why. It's his code to break if he wants. But I guess when you use a social media service to host your code these are expected and normal results.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#150

Post by rane »

laurowyn wrote: post #79
ruuda wrote: post #47

This is why you pin all dependencies and upgrade (and test) when it's convenient for _you_, not when the author pushes a new version.

Pin all you want, if the repo/vendor/maintainer pulls the release then you're not getting access to your dependencies at all. If anything, this is the reason you use pull-through proxies. Your proxy will hold the version you depend on, regardless of upstream drama. Keep your proxy backed up and you'll be able to use those dependencies until the end of time, or you finally decide to migrate to an alternative.

Offline cache with Yarn 2+ protects against this and other network failures when building CI, for example.
Post reply on HN