Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

If a thing has an expiry date that is >10 years, then you're not going to see any problems for 10 years. That doesn't mean the expiry date doesn't exist, or that the thing won't hit it. It can be wildly successful for all those years and then hit the expiry date and stop immediately.

1.It is totally in his prerogative to mess up the package he manages, but not to install into it malware. I am on the fence if this would count as malware. (Because of the open loop, but my leaning is that this is not malware.)

2. Github is, IMO, breaking any trust that I might have had by assuming control of the package, removing the last commit and keeping it online.

If they feel they have a reason to close it, they should. And, they then should fork it and put it up under their own name. Which would generate lots of bad press, but is at least within their rights.

3. I don't quite follow the logic of Github closing his account. Yes, I know that when you use $megacorp they WILL eventually close your account and make you sad. Google did it to me once and shut my gmail account. Tough luck for not being a millionaire.

4. You should always lock your NPM dependencies on a version, and update it when you can see what the results are.

5. Yes, the large corps really should be paying for all the work that is being done to help them, despite their hostile attitudes (being typed on a Mac. Guess who wrote the docs? Not Apple.)

6. Github has some perfectly good competitors, both SaaS (gitlab.com, sourcehut.org) and self-hosted (gitlab, gogs/gitea, etc)

Using them empowers you, and removes a wincy bit of leverage from $megacorp. Enough people follow suit, and the world will be a better place. And besides, Copilot won't steal or reveal your code.

7. There are more effective ways of making his point, but he worked out of emotion, not logic.

Eg. Perhaps he would have been able to change the license and demand compensation from all non-profits? That would provide both cash and publicity.

As a rule, it is always better to act out of logic than emotion, but us humans seem to have an issue with this. ;)

8. Is anyone stepping in to help the author get treatment?

I think they already have, those 2 examples you mentioned already happened and were dealt with.

I think intent is important to take into consideration, since after all that is the definition of malicious: intent to cause harm.

Your first example clearly has no intent to cause harm. That case probably happened thousands of time already since not everyone is willing/able to follow semver cleanly and strictly. Never heard about GH taking any measure against that. And I would definitely not expect them to as a user/maintainer.

For the second case, I think GH policy is that you can host that kind of PoCs, but the repo has to be clearly documented as doing such (e.g. you can't just add some vuln into some unrelated code "for research"), and the vulnerability cannot be an active one: "We understand that the publication and distribution of proof of concept exploit code has educational and research value to the security community, and our goal is to balance that benefit with keeping the broader ecosystem safe. In accordance with our Acceptable Use Policies, GitHub disabled the gist following reports that it contains proof of concept code for a recently disclosed vulnerability that is being actively exploited." - GitHub." [1]

Back to Marak's case, my opinion is that GH did the right thing: If he just had his code in a repo, with no semver, no other contributors/maintainers, and such, and decides to nuke it, then I hope GH would not have done anything.

But when you are using all the tools and trust of open source: Other people contributing to your repo, other people being active maintainers/admins and spending times out of their days to fix bugs on it, when you leverage NPM to make it easier for you to distribute your package to others widly etc, you give up the privilege being able to act unilaterally like an asshole without consequences.

[1]: https://www.bleepingcomputer.com/news/security/githubs-new-p...

He didn't go around submitting PRs to update the version of this. He didn't deploy anything into production.

You have the right to use the code for free, and he has the right to do terrible things with his code. If you don't like that arrangement, get him to sign a contract that includes responsibilities on his part like not shipping intentionally broken packages. Or get your distribution from someone that does have a responsibility to you.

I probably wouldn't do the same in his position, but I still support his (moral) right to do what he did. It's his project, and he can tank it if he wants to. Just like if I had a business, I could tank it if I wanted to. It's probably not a wise thing to do, but it is something I could do.