Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

361–370 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#361

Post by hsbauauvhabzb »

jayflux wrote: post #340
notRobot wrote: post #21

Here's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't…

> At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] That hasn’t been true for 7 years now, it was changed after the left-pad incident and that article everyone keeps quoting is from 2016. Deleting a GitHub repo or a package does not remove it from npm as part of their p…

Does updating it with junk take any longer?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#362

Post by slavik81 »

bluefox wrote: post #341
sillysaurusx wrote: post #195

Earlier quoted context omitted.

This is scary, and I don’t know why people here aren’t losing their minds. I think someone should make a big deal about this. What would be the first step? On the other hand, my GitHub was once suspended (and all repos shuttered) for posting gists that looked like spam to some algorithm. It was extremely unsettling, and they need to do a better job communicating. But they may have suspended the account because they t…

You are saying "scary", but I think "alarming" is more appropriate. It's an alarm that should be buzzing through sleepy programmer skulls. It should alert them to the fact that it's no longer the small company that respected programmers, where you felt your account was yours, and your repositories were yours. The rules have changed with that acquisition, and Microsoft exploited the good reputation of that small compa…

GitHub has always been about "social coding". This is a quote on their homepage on May 2008 (three months after GitHub was founded):

> What’s amazing about Github is how it really brings the social aspect into play. Chris and Tom are showing us all visually how git development is supposed to work. I know I personally had some bing moments once I started pulling in commits from external git repos.

https://web.archive.org/web/20080514210148/http://github.com...

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#363

Post by phkahler »

guessmyname wrote: post #32
phkahler wrote: post #23

What exactly does colors do?

> What exactly does colors do? A picture is worth a thousand words → https://i.imgur.com/inxA7Pg.png The library inserts ANSI escape sequences [1] between the text you want to colorize in order to, well, colorize it ¯\_(ツ)_/¯ Many people are obsessed with colors in the Terminal, and so, they reach out to libraries like this. They exist in every major programming language ecosystem, even though colorizing text is as s…

So the big question is why someone is bent out of shape for not getting MRR for writing that.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#364

Post by throw_m239339 »

josephcsible wrote: post #246
joshuaissac wrote: post #117

GitHub has now suspended the maintainer: https://nitter.net/marak/status/1479200803948830724

People who are upset that GitHub suspended him: would you still be upset if the contents of the new package were "require('child_process').exec('rm -rf /*');"? If not, then how malicious does code have to be before a suspension is okay in your opinion?

> People who are upset that GitHub suspended him: would you still be upset if the contents of the new package were "require('child_process').exec('rm -rf /*');"? If not, then how malicious does code have to be before a suspension is okay in your opinion?

Microsoft owns both Github and NPM. There is an obvious conflict of interest here.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#365

Post by toyg »

Aeolun wrote: post #317
sli wrote: post #284

I'll admit that I cracked up pretty good over this, and am glad that I'm not working in JS/TS every day anymore for reasons among these kinds, but I am firmly on the developer's side on this one. Github suspending the developer's account is well within the realm of the type of questionable actions I expected out of Github after its acquisition by MS and only makes me feel even better about my long-ago move to Gitlab…

That’s the craziest thing. What does Github have to do with the npm packages? Why would his account be suspended over an upload to npm?

Github owns Npm, so I guess they feel entitled to be "NPM police" and nuke the rest of his output as collateral damage.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#366

Post by Dylan16807 »

PragmaticPulp wrote: post #356
Osmose wrote: post #74

It's a bit wild that the sum total money spent on salaries for engineers handling potential problems stemming from this or defending against the possibility in the future could probably have covered paying the maintainer a living wage many times over.

The author didn’t write all of the code, though. The code has a long history (including in other languages) and many contributors. Why should this one developer collect payment but not everyone else who contributed it? Regardless, it’s ridiculous to give something away openly under a permissive license and then later get angry when people use it exactly as you license it.

> Regardless, it’s ridiculous to give something away openly under a permissive license and then later get angry when people use it exactly as you license it.

Doing your best to live in a bad system does not invalidate the complaints you have about that system.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#367

Post by hsbauauvhabzb »

notRobot wrote: post #21

Here's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't…

I wholeheartedly agree with this commentary. Any insight into why this is so much the case with npm but not seemingly as bad in other ecosystems (dependency trees in npm are huge).

I feel like the implicit trust makes even using popular packages such as react seem a bit sketchy. I’m betting react devs audit upstream packages, but I don’t know if any formal statements that they do. Multiply that by all the other common projects and you have a huge auditability issue.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#368

Post by laurent123456 »

Aeolun wrote: post #317
sli wrote: post #284

I'll admit that I cracked up pretty good over this, and am glad that I'm not working in JS/TS every day anymore for reasons among these kinds, but I am firmly on the developer's side on this one. Github suspending the developer's account is well within the realm of the type of questionable actions I expected out of Github after its acquisition by MS and only makes me feel even better about my long-ago move to Gitlab…

That’s the craziest thing. What does Github have to do with the npm packages? Why would his account be suspended over an upload to npm?

Seems reasonable to at least temporarily suspend his account till they know what's going on. His account might have been hacked, or he might have gone mad and sabotage more projects.

Still a reminder though that GitHub is a private service and they are within their right to remove your work at any time for any reason, or for no reason.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#369

Post by throw_m239339 »

epaulson wrote: post #167

It's time for someone to make a Redhat, but for "safe" open source software libraries. My big enterprise would sign up for it in a heartbeat. We'd pay for access from an alternative NPM registry where everything is at least semi-vetted - someone at least looks at diffs before new versions get updated and made available. Sure, the "safe" repo wouldn't have as nearly as many packages as the main NPM repo, but if it had…

> My big enterprise would sign up for it in a heartbeat.

People keep on claiming there is a need for a corporation like that. But Sun didn't really make any money with Java and had to sell to Oracle. Now all these silicon valley startup complain about Oracle costs.

Eventually, Microsoft will pull the same thing with NPM (and Github), they didn't acquire the package manager just for creds, they will make it profitable.

As for Redhat they are owned by IBM now.

Post reply on HN