Backdoor in event-stream library dependency
1–10 of 509 posts
Re: Backdoor in event-stream library dependency
#2Wow, looks like it was also used in Microsoft and BBC News repos.. unless I read the updates incorrectly. Perhaps the attacker was targeting a specific user?
Re: Backdoor in event-stream library dependency
#3Also note the same user owns this library:
https://github.com/right9ctrl/node-scrypt
I would be very suspicious of that as well and audit anything that library has touched.
Re: Backdoor in event-stream library dependency
#4I guess it's not npm specific, because the same thing can happen in any other open source repo, can't it? Some guy takes over maintenance of a dormant package and then adds code which no one bothers to check.
Re: Backdoor in event-stream library dependency
#5Is there a way to get stats on suspicious activity on NPM repos? I feel like this is a service that every node.js project is in need of after left-pad and now this.
Re: Backdoor in event-stream library dependency
#6Is there a way to get stats on suspicious activity on NPM repos? I feel like this is a service that every node.js project is in need of after left-pad and now this.
check them into your git
Re: Backdoor in event-stream library dependency
#7I really have a hard time putting as much blame on the author as the people in that Github thread are doing. Maybe they could have handled this specific issue a little better, but the underlying problem is just one of the flaws in the open source community that everyone has to accept. Maintaining a project is a lot of work (even just having your name attached to a dead project involves work) and the benefit from doing that work can be non-existent. If the original author has no use for the project anymore and someone offers to take it over from them, why should the author be expected to refuse? Isn't adding another potentially unknown maintainer generally better for the community than a project dying?
Re: Backdoor in event-stream library dependency
#8Is there a way to get stats on suspicious activity on NPM repos? I feel like this is a service that every node.js project is in need of after left-pad and now this.
Edit: Applies to any package manager, e.g. ruby gems, elixir hex packages, Python eggs.
Re: Backdoor in event-stream library dependency
#9It looks like no one is even sure what the code actually does? Or am I misreading that thread.
Re: Backdoor in event-stream library dependency
#10I guess it's not npm specific, because the same thing can happen in any other open source repo, can't it? Some guy takes over maintenance of a dormant package and then adds code which no one bothers to check.
Well, not really. Anyone can "take it over" in the sense of creating a new, maintained fork, but the various distro package managers have policies that I think generally require some review/approval process to transfer ownership of a package they publish. I don't know anything about NPM, but imagine it's a more lax process than something like Debian. It sounds like the maintainer here did something shady or simply reckless in effectively transferring ownership but not disclosing this to folks at NPM?