Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

851–860 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#851

Post by ydlr »

bastardoperator wrote: post #108

Should I get paid for my multiple contributions to faker (I don't think I should)? I've submitted several PR's for generating data all of which were accepted. Even back then the maintainer was barking about money... Honestly the project would be better off forked. He did not write this library entirely by himself, at this point I just see him as holding other committers contributions as hostage. It's a bad look, why…

> Honestly the project would be better off forked.

I agree. It was an irresponsible prank. But Microsoft didn't fork the projects. They hijacked his digital identity on two of their platforms, instead. I find that much disconcerting than what this one maintainer did.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#852

Post by bluefox »

yoavm wrote: post #707
bluefox wrote: post #496

Earlier quoted context omitted.

[flagged]

Knowingly?! Clearly every developer of an app breaking because of these packages had no idea their app is going to break, and clearly it was exactly the intention. They _were_ tricked. Can you not see a difference between this and between releasing a new package with a README saying "this module will print 'liberty liberty liberty' to your console in an infinite loop!"?

So you're saying he also had to document his code? Maybe make a pull request.

Every developer is responsible for what goes into his project, including dependencies. When a developer wants to update a dependency, he is responsible for the appropriateness of the update. In order to get an idea, he should audit the changes. For personal code, such an audit may constitute of a quick skim to determine that nothing breaks. For production code, it may also include a security audit.

When a dependency that used to do X now does Y and therefore breaks your stuff, you are the one responsible for dealing with it. The author disclaimed any warranty and any fitness of purpose for his project, and whether his intentions make sense or not is of no consequence.

My point was that there is no such thing as "malicious code". Code is code, and it's your responsibility to determine whether it fits the context. That someone put it out there with an MIT license means the responsibility is yours.

P.S. Ata nishma bachur magniv, lama macharta et ha'autobus? OK, ro'e she'ata gar be-Sverige achshav (Scandinavia ze ha'chalom sheli) az mevin.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#853

Post by newaccount74 »

ydlr wrote: post #851
bastardoperator wrote: post #108

Should I get paid for my multiple contributions to faker (I don't think I should)? I've submitted several PR's for generating data all of which were accepted. Even back then the maintainer was barking about money... Honestly the project would be better off forked. He did not write this library entirely by himself, at this point I just see him as holding other committers contributions as hostage. It's a bad look, why…

> Honestly the project would be better off forked. I agree. It was an irresponsible prank. But Microsoft didn't fork the projects. They hijacked his digital identity on two of their platforms, instead. I find that much disconcerting than what this one maintainer did.

How did they hijack his identity? They just reverted to an older version instead of the the malicious update, and suspended his account.

For them it must look like a malicious hacker took over the devs account, and reverting the malicious actors changes is exactly what I'd expect of a responsible custodian.

If you want to trick people into downloading malicious software, don't do it on someone else's platform.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#854

Post by selfhoster11 »

asddubs wrote: post #748
evouga wrote: post #556

Earlier quoted context omitted.

For a long time I've owned a premium GitHub account and would roll my eyes at colleagues who insisted on using GitLab, as I felt that GitHub had a clearly superior user experience. I have to say, though, that every time in recent memory that GitHub has popped up in the news, it's for something that's made me sigh. The only thing still keeping me one of their customers is the painfulness of transferring over all of my…

gitea seems pretty nice, but you have to host it yourself

Codeberg.org is a non-profit organisation that hosts Gitea for free.

Even if you do want to set up your own instance, it's very easy to do so. It's one of the least resource-intensive server applications I've seen - roughly 200-300 MB of RAM used on most days, minimal background CPU usage, statically linked Go binary or a Docker container according to preference. A Raspberry Pi with a few hundred megs of spare RAM or a sub $5 VPS will be sufficient.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#855

Post by anaganisk »

dagmx wrote: post #4
Comevius wrote: post #2

GitHub suspended access to their account for a commit to their own software, because it caused a problem for all these companies. For one it shouldn't have, like pinning a dependency and auditing all changes should be done ideally. These libraries are always licensed in a way that excludes warranty of any kind. But I honestly don't care if companies "exploit" open-source software by making money using them and not do…

GitHub ToS allow terminating accounts for malicious behaviour, which I'd argue that purposefully breaking downstream code is.

Then they must explicitly add a clause to all licenses no? That warranty is implicit.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#856

Post by obviousanswer9 »

lenkite wrote: post #695
obviousanswer9 wrote: post #642

Earlier quoted context omitted.

Quoted post unavailable.

The author should first change his LICENSE before he does crap like this. Make sure the terms of the license upfront state that "billion/trillion dollar companies" are not permitted to use this library. Stop using the MIT license for your hactivist project.

No post body was provided.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#857

Post by young_unixer »

bogwog wrote: post #277
sillysaurusx wrote: post #195

Earlier quoted context omitted.

This is scary, and I don’t know why people here aren’t losing their minds. I think someone should make a big deal about this. What would be the first step? On the other hand, my GitHub was once suspended (and all repos shuttered) for posting gists that looked like spam to some algorithm. It was extremely unsettling, and they need to do a better job communicating. But they may have suspended the account because they t…

Why is that scary? If you do bad things, you're going to get banned. This guy abused Github to distribute malicious code to thousands of projects. If losing your Github means losing your projects, that's on you for being lazy/irresponsible with them. Git is already decentralized, and anything important should be cloned on something you own.

> If you do bad things, you're going to get banned

No, that's not what the TOS says.

In the same way that being an asshole isn't illegal, doing "bad things" is not against the TOS.

> This guy abused Github to distribute malicious code to thousands of projects.

1. AFAIK he didn't abuse Github. He used the typical method of uploading code, into his own repo.

2. He didn't distribute the code, that was npm.

3. The code being malicious is your interpretation. Can code not contain political or nonsensical messages? I think people should be free to share code with political messages, or with nonsense if they want.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#858

Post by selfhoster11 »

mastazi wrote: post #430

My takeaway from this story is that I never really gave a thought about the fact that Github can close your account... And since on Github you are not allowed to have multiple accounts (e.g. personal vs work account), when that happens they are taking away your ability to work. I am going to set up a self hosted git server for my personal projects straight away. I am thinking about Gitea, any one can share their expe…

Gitea is very lightweight, easy to get started with, and all-around fantastic Git host, although it does less than Gitlab (I don't think it does CI as a built-in feature, for instance). The web interface is lightning-fast, almost as fast as a native app (no exaggeration here). I'd you have a little spare RAM and a CPU core, it's a great start to self-hosting Git. I have been running it for at least a year, and liked it.

If you want more of a one stop shop, Gitlab is a good alternative. The web UI is slower than Gitea, and the resource requirements specified really do match reality. Don't run it on less than quad core with 8GB of RAM, because it will be slow.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#859

Post by obviousanswer9 »

balls187 wrote: post #698
obviousanswer9 wrote: post #642

Earlier quoted context omitted.

Quoted post unavailable.

Most of what you wrote has merit, but I dont believe the author was trying to impart much of what you wrote. I let my comments inline with yours. > a) blindly 'updating' and deploying code without testing is a horrible idea This is important risk factor each organization should be aware of. Though he wasn't trying to convey this, it was merely a byproduct. > b) these trillion dollar corporations just take and take an…

[dead]

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#860

Post by goodpoint »

notRobot wrote: post #21

Here's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't…

> Packages are literally remote code exec vulns in the hands of package authors

Reminder: this is why traditional Linux distributions exist.

Post reply on HN