GitHub has now suspended the maintainer: https://nitter.net/marak/status/1479200803948830724
> #AaronSwartz right...
Yeah, this was really annoying to see. Don't use him as a pillar to your malicious action.
Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
461–470 of 1001 posts
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#462No post body was provided.
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#463My takeaway from this story is that I never really gave a thought about the fact that Github can close your account... And since on Github you are not allowed to have multiple accounts (e.g. personal vs work account), when that happens they are taking away your ability to work. I am going to set up a self hosted git server for my personal projects straight away. I am thinking about Gitea, any one can share their expe…
I've never heard of GitHub enforcing the multiple accounts thing, FWIW. This user was taking clearly malicious actions against millions of consumers of code, in a bait and switch style.
GitHub rarely takes action against accounts like that, don't let a sample size of one define them. There are lots of reasons to be annoyed with GitHub but this isn't one of them.
As for alternatives, check https://sr.ht
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#464Here's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't…
I wholeheartedly agree with this commentary. Any insight into why this is so much the case with npm but not seemingly as bad in other ecosystems (dependency trees in npm are huge). I feel like the implicit trust makes even using popular packages such as react seem a bit sketchy. I’m betting react devs audit upstream packages, but I don’t know if any formal statements that they do. Multiply that by all the other commo…
>> Any insight into why this is so much the case with npm but not seemingly as bad in other ecosystems (dependency trees in npm are huge).
I would think that the sheer popularity of the JavaScript (and therefore Node) ecosystems contributes partially to it - there's a massive industry out there about skilling new developers up in JavaScript, Node, and some front-end frameworks. But it definitely doesn't explain all of it.
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#465Earlier quoted context omitted.
The author didn’t write all of the code, though. The code has a long history (including in other languages) and many contributors. Why should this one developer collect payment but not everyone else who contributed it? Regardless, it’s ridiculous to give something away openly under a permissive license and then later get angry when people use it exactly as you license it.
> Regardless, it’s ridiculous to give something away openly under a permissive license and then later get angry when people use it exactly as you license it. Doing your best to live in a bad system does not invalidate the complaints you have about that system.
By publishing free, open source software he wasn't "doing his best to live in the system". That would involve exchanging his labor for currency.
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#466[deleted]
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#467My takeaway from this story is that I never really gave a thought about the fact that Github can close your account... And since on Github you are not allowed to have multiple accounts (e.g. personal vs work account), when that happens they are taking away your ability to work. I am going to set up a self hosted git server for my personal projects straight away. I am thinking about Gitea, any one can share their expe…
I've never heard of GitHub enforcing the multiple accounts thing, FWIW. This user was taking clearly malicious actions against millions of consumers of code, in a bait and switch style. GitHub rarely takes action against accounts like that, don't let a sample size of one define them. There are lots of reasons to be annoyed with GitHub but this isn't one of them. As for alternatives, check https://sr.ht
> I've never heard of GitHub enforcing the multiple accounts thing, FWIW
correct they don't enforce it but they make it such a royal PITA to switch accounts that I eventually gave up trying. They don't have an account switcher like Google etc.
> As for alternatives, check https://sr.ht
thank you! Checking it out.
Edit: it seems that sr.ht is not self-hosted though? I can see the link to create an account but I can't find instructions on how to install it on my own server.
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#468Here's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't…
I’m a self taught Python programmer. I haven’t don’t much front end. Why do some JS devs import tiny packages to do simple things? I don’t feel like I’ve seen this behavior in Python. Is it because browsers are an awful environment?
They took the Unix philosophy of doing one thing well and drove it off a cliff.
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#469Earlier quoted context omitted.
Yeah, I was a GitHub user in 2008. Though it obviously had a social aspect, it wasn't considered a "social network" type of site. Its ongoing transformation into one is a result of the acquisition by Microsoft.
I have always considered it a social network, 'the social network for young programmers' as I called it, which turned free software into social networking (portfolio for first employment(s), etc.), and that's why I always refused to create an account over there as I don't want to push those things even further, and got gradually more appalled as I watched projects following the trend and moving there one after the ot…
[deleted]
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#470Earlier quoted context omitted.
Published versions are immutable, you can only submit a new patch with a new version number. It's common for dependencies to be pinned to a minor version (getting patches automatically), however if you use a package-lock.json, as is the default/best-practice, I believe you should be guarded from any surprise patches. You would discover a change like the one in the OP when you manually ran `npm update` on your dev mac…
>You would discover a change like the one in the OP when you manually ran `npm update` on your dev machine, so it should get nowhere near production. Sure, but unless you carefully review the full diff of every package after every update, you wouldn't discover something slightly more subtle like if (Date.now() > 1648771200000) { require('child_process').exec("rm -rf ~") }
I mean... that's true if you ever use any code that you haven't read through line-by-line. That's not specific to package managers in general, much less NPM, so I think it's out of scope for this discussion.