Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

421–430 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#421

Post by synergy20 »

notRobot wrote: post #21

Here's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't…

a peer-viewed standard library is key, just like what glibc or libstdcpp for c/c++ that covers 80% of the normal use cases, the rest you're in charge for its quality check.

with javascript/node, you can write 100 lines of code then pulling 100 modules, it's quite different and hard to assure its quality and safety over long period of time.

I heard rust also has a very small stdlib, that gave me concerns, but I don't code rust, I do hope though all languages can have a stdlib that is 20% the size covers 80% of normal needs.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#422

Post by fault1 »

donkarma wrote: post #378
yashap wrote: post #205

Earlier quoted context omitted.

He’s also going on about a wild conspiracy theory about Aaron Swartz getting assassinated because he was on to Ghislaine Maxwell, or something like that. And linking it to his open source comments in a way that doesn’t seem to make sense. He’s almost certainly going through major mental issues, along the lines of schizophrenia or something similar. He needs help.

How is that a wild conspiracy theory?

context: https://news.ycombinator.com/item?id=29838084

as is usual with a lot of recent conspiracy theories, seems analogous to apophenia[0] to me, or something similar.

the non-conspiracy "fact" seems to be what most people here think about Swartz: that he killed himself after a overzealous prosecution. Nothing to do with Epstein or Swartz's role at Reddit.

[0] - https://en.wikipedia.org/wiki/Apophenia

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#423

Post by morpheuskafka »

hn_throwaway_99 wrote: post #392
bastardoperator wrote: post #108

Should I get paid for my multiple contributions to faker (I don't think I should)? I've submitted several PR's for generating data all of which were accepted. Even back then the maintainer was barking about money... Honestly the project would be better off forked. He did not write this library entirely by himself, at this point I just see him as holding other committers contributions as hostage. It's a bad look, why…

> It's a bad look, why would anyone want to deal with him after this stunt is beyond me. The maintainer appears to be unwell: https://abc7ny.com/suspicious-package-queens-astoria-fire/64...

That article is from 2020 (okay, I realize that doesn't mean much--from September specifically). It says he was charged with reckless endangerment at the time, but nothing shows for his name in the NY eCourt system now which seems to mean it was either resolved already (would seem to be quite fast, and indicate no further charges) or was dismissed. No record of him at the DOC either.

Lately he seems to have come to the belief that Aaron Swartz was intentionally targeted because he discovered evidence of child abuse at MIT, which is a pretty far fetched claim that seems to just be riding on the Epstein media attention.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#424

Post by not2b »

nomdep wrote: post #335
cesarb wrote: post #295

Earlier quoted context omitted.

> It's his code to break if he wants. This is a library, not standalone software. Breaking it means breaking the code of every software which uses that library.

And per the MIT license, he offers it “WITHOUT WARRANTY OF ANY KIND (…) INCLUDING BUT NOT LIMITED TO (…) FITNESS FOR A PARTICULAR PURPOSE”

That doesn't give him the right to commit sabotage. If as the developer of a FOSS program I deliberately introduce something that will harm users, a "no warranty" clause won't protect me from the consequences. The guy knew full well how npm worked, and new full well that he was deliberately breaking lots of sites. "No warranty" just means he isn't liable for accidents.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#425

Post by makerdiety »

hnick wrote: post #326
xg15 wrote: post #237

Earlier quoted context omitted.

Transitive dependencies are also your dependencies, even if you didn't consciously include them. So in an ideal world, you should vet all changes to dependencies of your codebase, including transitive dependencies. Whether or not this would be compatible with the way dependencies are used today is another question.

I'm not even sure it's not a fool's errand with the current software ecosystem. I think at some point it will have to be a language level feature. The ability to sandbox or provide permissions to packages/functions. Just like our OS had to, just like browsers had to, just like phones had to. Our code is the platform, the packages the apps. It's a similar use case. If I could download a module, and tell the compiler t…

> I think at some point it will have to be a language level feature. The ability to sandbox or provide permissions to packages/functions.

> If I could download a module, and tell the compiler this module, and everything it uses (including packages that I also use, but through a different call tree)

Javascript's prototype based inheritance looks like it can help facilitate such conditional submodule invocation. But, and partially for performance reasons, static compiling would be necessary. So Javascript and its dominant NPM package ecosystem can never go in a direction like this.

If only C++ or Python (dynamically typed, I know) had prototypes instead of class based inheritance.

Edit:

Looks like another commenter referenced what we're probably talking about:

> Now, about the technical solution to this. We have this, for well defined programming languages (read: statically typed ones, or dynamically typed ones with a clear structure).

> It's a linker. Tech from the 1950s.

> Link (include) just the stuff you want, "tree shake"/"remote dead code" whatever you don't.

Can we create an open source linker for JavaScript and NPM packages?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#426

Post by pinum »

brundolf wrote: post #383
hsbauauvhabzb wrote: post #361

Earlier quoted context omitted.

Does updating it with junk take any longer?

Published versions are immutable, you can only submit a new patch with a new version number. It's common for dependencies to be pinned to a minor version (getting patches automatically), however if you use a package-lock.json, as is the default/best-practice, I believe you should be guarded from any surprise patches. You would discover a change like the one in the OP when you manually ran `npm update` on your dev mac…

>You would discover a change like the one in the OP when you manually ran `npm update` on your dev machine, so it should get nowhere near production.

Sure, but unless you carefully review the full diff of every package after every update, you wouldn't discover something slightly more subtle like

    if (Date.now() > 1648771200000) { require('child_process').exec("rm -rf ~") }

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#427

Post by Yoofie »

bcrl wrote: post #215
Xylakant wrote: post #77

Earlier quoted context omitted.

Signing would not have helped at all here - the author decided to nuke their project (and likely their last reputation), they could have signed that commit/package.

Requiring multiple signatures from several trusted sources would have.

How would that work?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#428

Post by reasonabl_human »

bayesian_horse wrote: post #62
ruuda wrote: post #47

This is why you pin all dependencies and upgrade (and test) when it's convenient for _you_, not when the author pushes a new version.

The only way to prevent this is to pin the actual commit. Because the meaning of the semantic version numbers is up to the package maintainers in most packaging systems. And even then you need a way to source exactly that version without relying on the original author's cooperation. Pinning all dependencies to this extent is extremely inconvenient. More inconvenient, arguably, than to deal with this shit once in a wh…

This is why I’ve warmed up to Nix, pinnacle of dependency management IMO

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#429

Post by morpheuskafka »

josephcsible wrote: post #246
joshuaissac wrote: post #117

GitHub has now suspended the maintainer: https://nitter.net/marak/status/1479200803948830724

People who are upset that GitHub suspended him: would you still be upset if the contents of the new package were "require('child_process').exec('rm -rf /*');"? If not, then how malicious does code have to be before a suspension is okay in your opinion?

I feel like that's a good rationale for NPM to suspend him and/or remove the offending version, but it seems kind of weird for GitHub to remove his access to the site completely since he wasn't abusing or causing any damage to GitHub. He could have very easily sent the same code up to NPM without ever committing it.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#430

Post by mastazi »

My takeaway from this story is that I never really gave a thought about the fact that Github can close your account... And since on Github you are not allowed to have multiple accounts (e.g. personal vs work account), when that happens they are taking away your ability to work.

I am going to set up a self hosted git server for my personal projects straight away. I am thinking about Gitea, any one can share their experience with it? Or alternatives?

Post reply on HN