Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

861–870 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#861

Post by selfhoster11 »

Aeolun wrote: post #315
javchz wrote: post #301

I think as JS developers, this should be a wake-up call, to never trust npm semantic versioning if your project it's critical. In this case, it's a dev who decided to use his right of doing political activism at the cost of his reputation. But this it's a best-case scenario. Another dev of a popular NPM library could get hacked, and insert malware. I wonder if there are zombie servers out there mining crypto or doing…

Something tells me this update doesn’t quite go to production in a lot of cases. At least I don’t generate production data using faker.

Production? Some people only have a testing environment, with production maybe in the plans at some point.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#862

Post by goodpoint »

0x0nyandesu wrote: post #734
lrvick wrote: post #722

Earlier quoted context omitted.

Security auditor here. Every time I see a client importing unsigned code with no evidence anyone they trust has reviewed it, I flag it as a supply chain attack vector in their audit and recommend mitigations. Some roll their eyes, but I will continue to defend it is a serious issue almost every company has, particularly since I have exploited this multiple times to prove a point by buying a lapsed domain name that mi…

You can say the same thing about the entire Linux stack

No, serious Linux distributions audit their code.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#863

Post by young_unixer »

sillysaurusx wrote: post #195
joshuaissac wrote: post #117

GitHub has now suspended the maintainer: https://nitter.net/marak/status/1479200803948830724

This is scary, and I don’t know why people here aren’t losing their minds. I think someone should make a big deal about this. What would be the first step? On the other hand, my GitHub was once suspended (and all repos shuttered) for posting gists that looked like spam to some algorithm. It was extremely unsettling, and they need to do a better job communicating. But they may have suspended the account because they t…

npm has a history of unprofessionalism and arbitrary decision-making. See the whole left-pad fiasco

It wouldn't surprise me if banning the guy's account was the decision of someone at the npm team.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#864

Post by selfhoster11 »

gls2ro wrote: post #664
Aeolun wrote: post #339

Earlier quoted context omitted.

Like, I understand it. And he could easily have done something much more malicious, like running a ‘rm -rf /‘. This seems on the level of a very misplaced prank. I feel like people (and especially corporations thst have freely used the library for years) are overreacting a bit. This is just a warning signal that we depend on random packages too easily. The only thing standing between many products and disaster is the…

I think people overreact (or at least I overreact) because of two things: 1. A kind of "psychological contract" is in place between a package maintainer/creator and the developers using it and that is somewhere along the lines of "assuming good faith" or "good intentions" from the maintainer and giving back somekind of "kindness" to maintainer specially in cases of of some OSS (MIT, Apache, BSD-2/3 ...). This maintai…

The only contract that counts here is if they signed, you know, and actual written contract. With money changing hands, a consideration of services rendered for money paid.

No such thing was in place while money-rich corps got rich off his back. I can't blame him for getting fed up with this and reacting.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#865

Post by esarbe »

not2b wrote: post #22
esarbe wrote: post #10

Earlier quoted context omitted.

Why would the developer of any software that comes explicitly without warranty be hold responsible for downstream breakages? It's not as if one could force people to upgrade to newer versions and they can always keep depending on the old releases.

In this case, the developer's behavior was malicious: they intentionally caused damage. This is very different than some good faith change that breaks stuff downstream. Sure, the license says "no warranty". But github can decide that they won't tolerate vandals on their platform. It would be within their right to revert the bad change from the git database they hold, go back to the last good change and lock the devel…

> vandals on their platform.

Since it is his code; can you vandalize your own property?

> go back to the last good change and lock the developer out.

That's one reason for not using GitLab as source management tool. It gives them way too much power.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#866

Post by esarbe »

ulimn wrote: post #11
esarbe wrote: post #9

It's his software and he can do with it as he pleases. It's an MIT license, so there's no warranty whatsoever. I'm not convinced that GitHub has any business suspending his account.

If he can do as he pleases, can't GitHub as well?

Yes, fair enough.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#867

Post by esarbe »

viro wrote: post #626
esarbe wrote: post #10

Earlier quoted context omitted.

Why would the developer of any software that comes explicitly without warranty be hold responsible for downstream breakages? It's not as if one could force people to upgrade to newer versions and they can always keep depending on the old releases.

> be hold responsible for downstream breakages he's not, He's being held responsible for intentionally pushing malware

I don't think he pushed malware, did he? He just broke his own project and published the broken version. That's not pushing malware.

I don't get why people don't just pin versions, honestly.

I'm not saying he did a good thing. But neither did he push malware nor has he any obligation to publish unbroken packages. If you're using FOSS projects without a service contract, don't whine if something breaks.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#868

Post by esarbe »

viro wrote: post #630
deadbunny wrote: post #53

Earlier quoted context omitted.

What damage did they cause?

It crashes the servers that use the package?

So what?

He didn't force anyone to update to the new version, right? So how is it his problem? Some other entity had to go and update the version they depend on.

And if you now say "well, that happens automatically", I say; suites them right. They should have tested the stuff.

Not his problem.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#869

Post by esarbe »

josephcsible wrote: post #15
esarbe wrote: post #10

Earlier quoted context omitted.

Why would the developer of any software that comes explicitly without warranty be hold responsible for downstream breakages? It's not as if one could force people to upgrade to newer versions and they can always keep depending on the old releases.

In general, warranties only relate to accidental problems and have nothing to do with intentional sabotage.

He didn't force anyone to update their dependency, right? So at most you can blame him for enabling self-sabotage.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#870

Post by james_burden »

kodemager wrote: post #701
bastardoperator wrote: post #108

Should I get paid for my multiple contributions to faker (I don't think I should)? I've submitted several PR's for generating data all of which were accepted. Even back then the maintainer was barking about money... Honestly the project would be better off forked. He did not write this library entirely by himself, at this point I just see him as holding other committers contributions as hostage. It's a bad look, why…

I think it’s a bad stunt that outlines an issue with mega corps using oss and blindly updating their packages. Or anyone blindly updating their packages really. But I don’t see how GitHub has the right to suspend him and rewind his work. I mean, that has to be a copyright infringement if there ever was one.

It makes sense if you replace GitHub with Microsoft in your sentence ; )
Post reply on HN