Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

Post by guessmyname » Sun, Jan 09, 2022, 10:58 PM UTC

hnthrowaway0315 wrote: post #127

guessmyname wrote: post #32

Earlier quoted context omitted.

> What exactly does colors do? A picture is worth a thousand words → https://i.imgur.com/inxA7Pg.png The library inserts ANSI escape sequences [1] between the text you want to colorize in order to, well, colorize it ¯\_(ツ)_/¯ Many people are obsessed with colors in the Terminal, and so, they reach out to libraries like this. They exist in every major programming language ecosystem, even though colorizing text is as s…

Why wouldn't everyone roll their own solution? Doesn't seem to be a huge thing to me, but I could be wrong...

Post by xg15 » Sun, Jan 09, 2022, 10:59 PM UTC

drawkbox wrote: post #97

notRobot wrote: post #21

Here's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't…

Dependencies are a major attack vector now. Tread carefully with all the supply chain attacks out there, it might not even be the authors doing these. We are entering a dependency attack massive war. Dependencies are a balance but also a sign of weakness of a system in the modern day. There at least needs to be delayed, dependency bot like analysis before you integrate. Even then, they just leave your systems open to…

Post by tester756 » Sun, Jan 09, 2022, 10:59 PM UTC

joshuaissac wrote: post #117

GitHub has now suspended the maintainer: https://nitter.net/marak/status/1479200803948830724

Post by oblio » Sun, Jan 09, 2022, 10:59 PM UTC

jakub_g wrote: post #131

oblio wrote: post #82

Earlier quoted context omitted.

It's both technical and cultural. Javascript is used on the front end. Front end devs obsess (or at least used to obsess) over download sized. So you'd have crazy stuff like custom builds of Underscore ( https://underscorejs.org/ ) with just the functions you wanted. Think manual sandboxing, if that makes any sense. You could get a package of Underscore with just map, filter and reduceRight, if you wanted to. Now, wh…

The problem with tree shaking has been twofold: - JavaScript is a very dynamic language with dynamic property access and a few other features that make it hard to guarantee that the linker won't accidentally remove too much - historically there was no standardized "module" format until ESM (ES modules) came up (with some time in between with few competing non-standardized proposals), so statically analyzing exports/i…

Post by codebje » Sun, Jan 09, 2022, 10:59 PM UTC

oblio wrote: post #104

detaro wrote: post #65

Earlier quoted context omitted.

How does that solve the issue here of new broken versions of packages being published?

That's another JS ecosystem widespread malpractice. Autobumping versions, or version ranges as they're called in Maven land. Dependencies should only use fixed versions and all updates should be manual. You should only use auto-upgradable versions during development, and the package manager should warn you that you're using them (or your dependencies are).