NPM package compromised by author: erases files on RU / BY computers on install

Post by foverzar » Thu, Mar 17, 2022, 7:18 PM UTC

vimax wrote: post #32

btreecat wrote: post #5

I don't know how I feel about this. One hand, this is a seemingly non-violent and subtle way to protest. On the other, the potential collateral damage is huge and just burns all trust with this developer, and is a net harm to the ecosystem as a whole. FOSS is great, because we were actually able to track the changes here. But it also points out how many packages go un-checked and just installed into a container runni…

Its childish. Striking out maliciously at random web developers surrounded by state propaganda is counter-productive. This just annoys them and feeds the narrative that they're under attack by the West who hates them. I would imagine web developers over there, being more educated, technical, and exposed to the West, would be the ones less likely to support the war. There's nothing subtle about wiping files, why not p…

Post by foverzar » Thu, Mar 17, 2022, 7:26 PM UTC

zozbot234 wrote: post #17

chizhik-pyzhik wrote: post #6

Regardless of your political position, this falls well within the definition of malware. It's irresponsible for the maintainer to allow this: https://github.com/RIAEvangelist/node-ipc/issues/233

Plenty of existing ransomwares delete user files on everything- but -RU machines. Perhaps the maintainer of this package subscribes to the old view that "turnabout is fair play".

Post by mannerheim » Thu, Mar 17, 2022, 8:27 PM UTC

foverzar wrote: post #160

coolspot wrote: post #112

There is a possibilty that Russia reports that through Interpol Cybercrime or via diplomatic channel, then FBI will have to investigate and possibly lock up Brandon.

No, this mechanism is simply not working. Western politicians and public media have been bashing and portraying Russia as "a haven for hackers" for some time now, but it's not like the US is any better from Russian perspective. Russian law enforcement has huge stacks of unsolved cybercrime cases, that are essentially blocked by lack of cooperation from a foreign counterpart.

Post by JonChesterfield » Fri, Mar 18, 2022, 12:27 AM UTC

encryptluks2 wrote: post #94

JonChesterfield wrote: post #82

Comments seem split between "that's illegal, beware the lawyers" and "don't RCE yourself then cry about it". I've got some bash scripts on GitHub that would delete files on the local machine if run. Today I don't care if anyone else runs them. If however the winds are blowing towards people doing themselves harm with my code is my problem, I guess I should delete the code I've published. Bad precedent to see here.

Big difference between random code on GitHub and modifying a high-use JS dependency to delete user files. I'm not against protesting in software, for example printing something to stdout during install, but deleting files is malicious beyond reprieve.

Post by lopis » Fri, Mar 18, 2022, 8:21 AM UTC

urthor wrote: post #81

chizhik-pyzhik wrote: post #6

Regardless of your political position, this falls well within the definition of malware. It's irresponsible for the maintainer to allow this: https://github.com/RIAEvangelist/node-ipc/issues/233

This still goes to the heart of the obligations of maintainers. "THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWI…