Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

551–560 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#551

Post by ehnto »

jayflux wrote: post #340
notRobot wrote: post #21

Here's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't…

> At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] That hasn’t been true for 7 years now, it was changed after the left-pad incident and that article everyone keeps quoting is from 2016. Deleting a GitHub repo or a package does not remove it from npm as part of their p…

They can still delete the package from NPM can't they?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#552

Post by josephcsible »

ehnto wrote: post #551
jayflux wrote: post #340

Earlier quoted context omitted.

> At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] That hasn’t been true for 7 years now, it was changed after the left-pad incident and that article everyone keeps quoting is from 2016. Deleting a GitHub repo or a package does not remove it from npm as part of their p…

They can still delete the package from NPM can't they?

Not usually: https://docs.npmjs.com/policies/unpublish

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#553

Post by shagie »

toyg wrote: post #365
Aeolun wrote: post #317

Earlier quoted context omitted.

That’s the craziest thing. What does Github have to do with the npm packages? Why would his account be suspended over an upload to npm?

Github owns Npm, so I guess they feel entitled to be "NPM police" and nuke the rest of his output as collateral damage.

NPM has been tightening up its publish and unpublish rules for over half a decade. https://thenewstack.io/the-kik-kerfuffle/

That GitHub is now the owner of NPM doesn't change that policy and maturing of the environment.

https://blog.npmjs.org/post/141577284765/kik-left-pad-and-np...

> We dropped the ball in not protecting you from a disruption caused by unrestricted unpublishing. We’re addressing this with technical and policy changes.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#554

Post by commandlinefan »

gilmore606 wrote: post #432
commandlinefan wrote: post #93

Earlier quoted context omitted.

> pin all dependencies You do that. Your coworkers don't. And they'll complain to your boss if you try to make them.

> And they'll complain to your boss if you try to make them. Really? Have I led a sheltered life? I cannot rightly apprehend the state of mind that would see pinning deps as bad. It only helps you!

But it takes longer than not doing it.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#555

Post by heartbreak »

betwixthewires wrote: post #501
not2b wrote: post #424

Earlier quoted context omitted.

That doesn't give him the right to commit sabotage. If as the developer of a FOSS program I deliberately introduce something that will harm users, a "no warranty" clause won't protect me from the consequences. The guy knew full well how npm worked, and new full well that he was deliberately breaking lots of sites. "No warranty" just means he isn't liable for accidents.

No warranty means he isn't liable for any behavior of the software at all. You don't have to like it but it is true.

He is responsible for his own behavior, and harming with intent is not a liability that can be waived in the US. This is literally first week of Contracts course material in law school.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#556

Post by evouga »

sillysaurusx wrote: post #195
joshuaissac wrote: post #117

GitHub has now suspended the maintainer: https://nitter.net/marak/status/1479200803948830724

This is scary, and I don’t know why people here aren’t losing their minds. I think someone should make a big deal about this. What would be the first step? On the other hand, my GitHub was once suspended (and all repos shuttered) for posting gists that looked like spam to some algorithm. It was extremely unsettling, and they need to do a better job communicating. But they may have suspended the account because they t…

For a long time I've owned a premium GitHub account and would roll my eyes at colleagues who insisted on using GitLab, as I felt that GitHub had a clearly superior user experience.

I have to say, though, that every time in recent memory that GitHub has popped up in the news, it's for something that's made me sigh. The only thing still keeping me one of their customers is the painfulness of transferring over all of my existing repositories.

You are, of course, entirely right: GitHub shouldn't be banning users for pushing code to their own repository (with the exception of if the commit contains copyrighted or illegal material, which clearly is not the case here), nor under any circumstances should they be commandeering their user's code and continuing to distribute it without the user's consent.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#557

Post by ehnto »

halostatue wrote: post #460
brundolf wrote: post #388

Earlier quoted context omitted.

> it defaults to specifying a semver compatible version in package.json, rather than doing the secure thing and pinning a version Note that if you have a package-lock.json (which you will by default), it will prevent any surprise updates even within the semver range specified. You have to manually run `npm update` to get the latest versions that match your semver. Personally I think this is the best middle-ground.

This is, unfortunately, not true by default. I had a case where I did `yarn install` and there were updates installed. To make this work correctly, you need to do `yarn install --frozen-lock-file` or `npm ci`. It’s absolutely _insane_ that this is the case. Gemfile.lock, Cargo.lock, and every other lock file format that I have used in packaging does this correctly.

It used to be true. npm install used to do what npm ci does. It was super annoying to learn that the hard way.

One of the core issues of NPM style package management is package bloat means you absolutely can't review all release notes for every module in your tree. So you just trust the top level packages, and pray they would mention something if their dependencies change how they themselves work. Practically I rarely see anyone read release updates for even those top level packages, they just update everything and test then send it up to prod is very typical.

If you are cool with that, rad, but it's the pinnacle of the fast food tech ethos literring software right now. Everyone is moving so fast that you barely get to learn something properly or maintain it well enough before it's defunct and we are on to the next thing. I might have a slightly bias view of it, working mostly for agencies I see a lot of projects.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#558

Post by bruce511 »

franciscop wrote: post #267
msoad wrote: post #141

I do free work for open source _a lot_. I have a rather controversial opinion on this. I don't think I should be paid for my work because the moment money comes in I have to be responsible for the work I was doing for fun. I enjoy building cool things others can use for free and I want to reserve the right to respond to feature requests with a simple "PRs are welcome! :)". I get my paycheck from my employer and I hav…

I have a different opinion, but I respect yours; and that's the basis of open source. There's many, many vastly different reasons why people do open source, and partly probably why we haven't "banded together to get paid" so to speak. For me, if I got donations that'd be great, but it'd not create a different sense of responsibility for my work, I'd keep doing exactly the same (unless I was explicitly hired as a cont…

So, in essence, I think you're saying that you choose a license depending on your goals for a project. Which seems reasonable.

More reasonable than folks who release under a license, then complain when others do exactly what the license allows.

I see a lot of "but give nothing back" complaints from some open source folk, but I've looked hard and I don't see a "give something back" clause anywhere, at least not in the licenses I'm using.

What I do see are "give something forward" clauses, which explicitly target customers, not suppliers.

I like and use open source as much as the next guy, but for my day job I code for money. Alas so far Open Source pays no bills.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#559

Post by viro »

thr0wawayf00 wrote: post #445
not2b wrote: post #418

Earlier quoted context omitted.

This wasn't a "protester". It was deliberate sabotage, done with full knowledge that it would cause major damage. GitHub is with its rights to kick this guy off. It would even be within its rights to take over that account and fix the introduced bug (by reverting the change or otherwise). That wouldn't prevent the original developer from maintaining their own broken version, but npm and GitHub could eliminate it if t…

> It was deliberate sabotage, done with full knowledge that it would cause major damage. That's how protesting often works. Deliberately interfering in normal affairs is a very common protest tactic. Just look at the interstate shutdowns after the George Floyd killing, or going back to Rosa Parks and the Montgomery bus boycott, worker strikes, etc. etc. That's exactly how protest works. Forcing application code to pr…

Minus my Hoobs setup was literally knocked offline over that stupid ass stunt. Care to describe to me how that isn't a violation of the CFAA? The fact that you think that crashing RANDOM servers that you DONT know what they do is an ok form of protest is INSANE

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#560

Post by [deleted] »

x86_64Ubuntu wrote: post #456
ahiknsr wrote: post #280

Earlier quoted context omitted.

> It's his code to break if he wants > I don't understand why If he can break his code because he is the owner then shouldn't the same reasoning apply for Github suspending the account?. It is their website and their rules. Keep in mind Github owns npm and the author has published a malicious package to npm which has 20 millions of downloads so I'm not surprised.

For some reason, people are adopting the ideologically inconsistent position full property rights to the dev, but no property rights to Github.

[deleted]
Post reply on HN