NPM package compromised by author: erases files on RU / BY computers on install

Post by planetree » Thu, Mar 17, 2022, 11:02 AM UTC

celticninja wrote: post #36

Isthatablackgsd wrote: post #34

Earlier quoted context omitted.

Look like they realized the ramification and suddenly changed their payload. Well, that won't help them since companies who uses this module will have their legal department barking. They cannot erase the damage they have done and try to get away of the ramification with version. Since this is distributed through GitHub, Microsoft legal possibly will be involved due to possible violation of cyber/hacking laws in vari…

I don't see any issue for the developers at all. It is their software to create and alter as they see fit. End users choose to use the package, it is not being installed on their machines without their knowledge.

Post by cookieswumchorr » Thu, Mar 17, 2022, 11:38 AM UTC

kbart wrote: post #129

kelnos wrote: post #108

Earlier quoted context omitted.

This is the sad thing about all of this. Many people are demonizing average Russian citizens for the actions of their government. When the US invaded Iraq in 2003, I was very much against it, but felt powerless to change the course of my government. (And the US government kept on doing what it felt like, no matter how unjust its actions.) While I was ashamed of my country's actions, I didn't think it would be fair fo…

Majority of average Russian citizens support their goverment actions against Ukraine. So in my book, they are also responsible.

Post by QuadmasterXLII » Thu, Mar 17, 2022, 12:15 PM UTC

0x_rs wrote: post #26

Honestly a very harmful sort of "doing something about it". As if deleting someone's (presumably, normal people) files will make them more understanding of the difficulties in the ongoing conflict. Lying about it is also petty, as seen below. Malicious software is malicious regardless of any intentions and should be prosecuted as such. And if one really feels obliged to make their part as they wish, there's many exam…

Post by rcxdude » Thu, Mar 17, 2022, 1:03 PM UTC

isitmadeofglass wrote: post #120

bryanrasmussen wrote: post #86

Earlier quoted context omitted.

>If they want to publish their upstream as malware, okay. I think you'll find that argument will not be very persuasive to a judge if the case is that the author of the software knowingly adds code in after people have integrated it into their systems that on purpose damages those systems. Intention will often carry weight, and no claiming of rights and purity and see I wrote here you can't do anything to me! is goin…

If you sign a contract stating that you get 10k and in return I get to destroy your property. A judge is not very likely to enforce the payment but state that I should not destroy your property “because obviously thats not something you would like” The license grants you usage but you agree to no responsibility for damages. You can’t cherry pick half of it, that defies the entire point of a license. The fact that you…

Post by lamp987 » Thu, Mar 17, 2022, 2:11 PM UTC

QuadmasterXLII wrote: post #145

0x_rs wrote: post #26

Honestly a very harmful sort of "doing something about it". As if deleting someone's (presumably, normal people) files will make them more understanding of the difficulties in the ongoing conflict. Lying about it is also petty, as seen below. Malicious software is malicious regardless of any intentions and should be prosecuted as such. And if one really feels obliged to make their part as they wish, there's many exam…

At this point any damage to the Russian economy translates to Ukranian lives saved.