Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

401–410 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#401

Post by ghiculescu »

throw_m239339 wrote: post #364
josephcsible wrote: post #246

Earlier quoted context omitted.

People who are upset that GitHub suspended him: would you still be upset if the contents of the new package were "require('child_process').exec('rm -rf /*');"? If not, then how malicious does code have to be before a suspension is okay in your opinion?

> People who are upset that GitHub suspended him: would you still be upset if the contents of the new package were "require('child_process').exec('rm -rf /*');"? If not, then how malicious does code have to be before a suspension is okay in your opinion? Microsoft owns both Github and NPM. There is an obvious conflict of interest here.

... it’s not obvious to me?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#402

Post by noah_buddy »

hn_throwaway_99 wrote: post #392
bastardoperator wrote: post #108

Should I get paid for my multiple contributions to faker (I don't think I should)? I've submitted several PR's for generating data all of which were accepted. Even back then the maintainer was barking about money... Honestly the project would be better off forked. He did not write this library entirely by himself, at this point I just see him as holding other committers contributions as hostage. It's a bad look, why…

> It's a bad look, why would anyone want to deal with him after this stunt is beyond me. The maintainer appears to be unwell: https://abc7ny.com/suspicious-package-queens-astoria-fire/64...

The maintainer seems a few steps beyond unwell. Seems like he was planning a terrorist act of some sort. Even if one is mentally unwell, I would not first describe them that way should they choose to premeditate harm against others. If you're building bombs, you're almost certainly at that point. At the very least, the maintainer is unstable if not actively malicious and seeking to cause harm however he can.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#403

Post by chmod775 »

laurowyn wrote: post #79
ruuda wrote: post #47

This is why you pin all dependencies and upgrade (and test) when it's convenient for _you_, not when the author pushes a new version.

Pin all you want, if the repo/vendor/maintainer pulls the release then you're not getting access to your dependencies at all. If anything, this is the reason you use pull-through proxies. Your proxy will hold the version you depend on, regardless of upstream drama. Keep your proxy backed up and you'll be able to use those dependencies until the end of time, or you finally decide to migrate to an alternative.

> Pin all you want, if the repo/vendor/maintainer pulls the release then you're not getting access to your dependencies at all.

And that's among the reasons people have started to commit their node_modules folders.

It has the neat side-effect of making people take a closer look at all the crap their pulling in too.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#404

Post by vultour »

bogwog wrote: post #277
sillysaurusx wrote: post #195

Earlier quoted context omitted.

This is scary, and I don’t know why people here aren’t losing their minds. I think someone should make a big deal about this. What would be the first step? On the other hand, my GitHub was once suspended (and all repos shuttered) for posting gists that looked like spam to some algorithm. It was extremely unsettling, and they need to do a better job communicating. But they may have suspended the account because they t…

Why is that scary? If you do bad things, you're going to get banned. This guy abused Github to distribute malicious code to thousands of projects. If losing your Github means losing your projects, that's on you for being lazy/irresponsible with them. Git is already decentralized, and anything important should be cloned on something you own.

No post body was provided.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#405

Post by pas »

hsbauauvhabzb wrote: post #361
jayflux wrote: post #340

Earlier quoted context omitted.

> At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] That hasn’t been true for 7 years now, it was changed after the left-pad incident and that article everyone keeps quoting is from 2016. Deleting a GitHub repo or a package does not remove it from npm as part of their p…

Does updating it with junk take any longer?

dependabot (GitHub's free? notifier) is probably the biggest risk factor in npm supply-chain attacks. Because who audits the actual diffs?

"npm-crev" can't come soon enough...

https://web.crev.dev/rust-reviews/ https://github.com/crev-dev/cargo-crev

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#406

Post by throw_m239339 »

29athrowaway wrote: post #334
greyface- wrote: post #333

Earlier quoted context omitted.

What consideration, if any, should package maintainers receive in return for legally binding themselves in this way?

The publication of their package.

> The publication of their package.

AKA peanuts.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#407

Post by throw_m239339 »

rjhackin wrote: post #251

Do you think npm is a flawed design ?

Yes it is absolutely, but it was by design, in order to generate growth for NPM the company at the expense of the Node.js community. I'm not saying this, Node.js creator said that.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#408

Post by dangus »

epaulson wrote: post #167

It's time for someone to make a Redhat, but for "safe" open source software libraries. My big enterprise would sign up for it in a heartbeat. We'd pay for access from an alternative NPM registry where everything is at least semi-vetted - someone at least looks at diffs before new versions get updated and made available. Sure, the "safe" repo wouldn't have as nearly as many packages as the main NPM repo, but if it had…

Organizations already solve this by mirroring repositories with tools like JFrog Artifactory.

New versions of packages are verified, approved, and mirrored.

(The revenue split part isn't really a part of that, but you're not really guaranteed revenue as soon as you choose an open source license. You have to make some kind of value-add like support or cloud services as a complementary upsell.)

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#409

Post by bmn__ »

bdcravens wrote: post #276
bastardoperator wrote: post #108

Should I get paid for my multiple contributions to faker (I don't think I should)? I've submitted several PR's for generating data all of which were accepted. Even back then the maintainer was barking about money... Honestly the project would be better off forked. He did not write this library entirely by himself, at this point I just see him as holding other committers contributions as hostage. It's a bad look, why…

Not to mention the fact that this is just a port of faker from Ruby and Perl (from last version's README, "faker.js was inspired by and has used data definitions from ...")

"inspired" my ass. It's a fork, not keeping the licence terms.

https://news.ycombinator.com/item?id=27254092

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#410

Post by krapp »

Osmose wrote: post #74

It's a bit wild that the sum total money spent on salaries for engineers handling potential problems stemming from this or defending against the possibility in the future could probably have covered paying the maintainer a living wage many times over.

The maintainer gave their work away for free. By definition - and by explicit license it isn't worth any wage, much less a "living wage many times over."

The maintainer wants to have their cake and eat it too - they likely believe in FOSS for moral reasons yet consider it immoral when companies take their software and use it freely under the terms offered.

If you want people to pay you for your work, don't give it away for free. If you give it away for free, don't have a temper tantrum if someone gets rich off of your work without compensating you, because those were the rules you chose to play under.

Post reply on HN