Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Node.js koa-router package transferred to unknown user

github.com

Post reply on HN
Print view View original

21–30 of 48 posts

Re: Tell HN: Node.js koa-router package transferred to unknown user

#21

Post by niftylettuce »

amingoia wrote: post #20

Please stop harassing me. Let's set the record straight. The Koa organization did not write, maintain, or ever help with this package. I wrote it. I maintained it, with help from people who reached out to me directly (and actually contributed code). @ZijianHe offered to maintain it, and I agreed to let him maintain it. Our relationship is not anyone's business. I don't have a relationship to the koa organization. I d…

To clarify things for the community:

1) No, they (Chinese developers) have not contributed more. You revoked access from @jbielick who was #2 contributor to the package behind you. He messaged me in Slack today that he received zero notification from you and simply received a notification from NPM that he was removed access from the package. You removed his access completely from NPM.

2) My email to you prefaced the concern of the China-based user with "completely unknown" and "To an outsider". Here's the original email to clarify it for people viewing this from an incorrect context:

    Hi Alex,

    Thanks for your work in the open source community.

    I am curious, since the project is open source, if you will be transparent as to the transfer of the koa-router repository and NPM ownership to a completely unknown user "ZijianHe" to the community.  Was there a monetary transaction?  Why did you choose him?  Why not transfer to the KOA org?

    To an outsider, this is all a huge red flag, as an unknown Chinese GitHub user suddenly has full control of a NPM package with 130K weekly downloads and is used by major corporations.
3) I did not "repeatedly" assert that. I stated the word "Chinese" one time. One time is not "repeatedly". I would share with the community your response to my message, but I am not going to do so.

Re: Tell HN: Node.js koa-router package transferred to unknown user

#22

Post by shaunw321 »

amingoia wrote: post #20

Please stop harassing me. Let's set the record straight. The Koa organization did not write, maintain, or ever help with this package. I wrote it. I maintained it, with help from people who reached out to me directly (and actually contributed code). @ZijianHe offered to maintain it, and I agreed to let him maintain it. Our relationship is not anyone's business. I don't have a relationship to the koa organization. I d…

Hey amingoia, thanks for responding. I think the worry here is bigger than this single situation and is really about package maintenance and ownership for the community at large. This is a very popular package. Selling it to anyone just to move on is a burden on open source. I will say it is completely your choice here, but as a consumer of the package and the other 130K+ a week I would urge you and others to be a bit more careful when transferring ownership.

Re: Tell HN: Node.js koa-router package transferred to unknown user

#23

Post by bearmcbearsly »

javitury wrote: post #12

koa-router was owned by @alexmingoia and not by @koajs. Still it is a central piece of the koa framework that compromises practically every koa setup. The only alternative I have found is this: https://github.com/koajs/trie-router The transition from express to koa has been slow, and this doesn't help. It will undermine the confidence on the koa framework.

Now that you can trivially use async functions as express handlers, what are the major benefits of transitioning to Koa?

Re: Tell HN: Node.js koa-router package transferred to unknown user

#24

Post by _bxg1 »

lioeters wrote: post #16

Although nothing malicious has happened yet, that change in the readme ("this package name is for sale") is spammy and concerning. Kudos on niftylettuce (love your blog!) for raising awareness. This is yet another example of a (by now fairly known) vulnerability in the npm package ownership transfer process. Just a few months ago, there was a big drama with malicious code found in a popular package `event-stream`, pl…

Woof. I didn't even notice the "for sale" part at first. That's probably the biggest red flag. You should never sell a backdoor into thousands of codebases to the highest bidder.

Of course, the real problem is thousands of codebases shouldn't be banking on the honor system for stuff like this.

Re: Tell HN: Node.js koa-router package transferred to unknown user

#25

Post by _bxg1 »

amingoia wrote: post #20

Please stop harassing me. Let's set the record straight. The Koa organization did not write, maintain, or ever help with this package. I wrote it. I maintained it, with help from people who reached out to me directly (and actually contributed code). @ZijianHe offered to maintain it, and I agreed to let him maintain it. Our relationship is not anyone's business. I don't have a relationship to the koa organization. I d…

Setting aside everything racial, do you know @ZijianHe personally, or was he simply the highest bidder? That's what this all comes down to. Thousands of people (apparently) put trust in you not to backdoor their codebases, and if you simply sold that vector to a random person, that's at best a hugely irresponsible decision.

Re: Tell HN: Node.js koa-router package transferred to unknown user

#26

Post by gnahckire »

amingoia wrote: post #20

Please stop harassing me. Let's set the record straight. The Koa organization did not write, maintain, or ever help with this package. I wrote it. I maintained it, with help from people who reached out to me directly (and actually contributed code). @ZijianHe offered to maintain it, and I agreed to let him maintain it. Our relationship is not anyone's business. I don't have a relationship to the koa organization. I d…

> Let's set the record straight... @ZijianHe offered to maintain it, and I agreed to let him maintain it. Our relationship is not anyone's business.

Why not be transparent about selling the package? Or attempting to do so?

> Chinese developers have contributed more to this repository than anyone from the Koa organization. This kind of racial scaremongering or guilt by association is not acceptable. Its offensive.

Nice rhetoric here. But you know the Country of origin of most cyber attacks is China right?

Source: https://www.csis.org/programs/cybersecurity-and-governance/t...

> I'm not going to say anything more on this issue. This is beyond ridiculous.

Suit yourself. But it really isn't. Sorry for all the harassment you're getting but, it's not exactly unwarranted...

Re: Tell HN: Node.js koa-router package transferred to unknown user

#27

Post by Sytten »

bearmcbearsly wrote: post #23
javitury wrote: post #12

koa-router was owned by @alexmingoia and not by @koajs. Still it is a central piece of the koa framework that compromises practically every koa setup. The only alternative I have found is this: https://github.com/koajs/trie-router The transition from express to koa has been slow, and this doesn't help. It will undermine the confidence on the koa framework.

Now that you can trivially use async functions as express handlers, what are the major benefits of transitioning to Koa?

None to be honest. I migrated my projects back to express. Most of the packages for koa are either unmaintained or not very active.

Re: Tell HN: Node.js koa-router package transferred to unknown user

#28

Post by pryce »

_bxg1 wrote: post #25
amingoia wrote: post #20

Please stop harassing me. Let's set the record straight. The Koa organization did not write, maintain, or ever help with this package. I wrote it. I maintained it, with help from people who reached out to me directly (and actually contributed code). @ZijianHe offered to maintain it, and I agreed to let him maintain it. Our relationship is not anyone's business. I don't have a relationship to the koa organization. I d…

Setting aside everything racial, do you know @ZijianHe personally, or was he simply the highest bidder? That's what this all comes down to. Thousands of people (apparently) put trust in you not to backdoor their codebases, and if you simply sold that vector to a random person, that's at best a hugely irresponsible decision.

It may even be completely innocent and valid for a developer to do this, but :

1. there seems to be -intentionally- very little transparency about it,

2. the second most prominent contributor - who was also the most prominent contributor for the last two years - was, we are told, locked out without notice

3. the original developer has repeatedly declined to acknowledge that the community has (or could have) any concerns worth even discussing.

4. the Github history indicates a strong possibility the package was bought.

If someone wants to sell their package, perhaps they have every right to, but the author's repeated dismissal that anyone might be legitimately concerned or legitimately want to know more about this process is bizarre and alarming.

Re: Tell HN: Node.js koa-router package transferred to unknown user

#29

Post by [deleted] »

gnahckire wrote: post #26
amingoia wrote: post #20

Please stop harassing me. Let's set the record straight. The Koa organization did not write, maintain, or ever help with this package. I wrote it. I maintained it, with help from people who reached out to me directly (and actually contributed code). @ZijianHe offered to maintain it, and I agreed to let him maintain it. Our relationship is not anyone's business. I don't have a relationship to the koa organization. I d…

> Let's set the record straight... @ZijianHe offered to maintain it, and I agreed to let him maintain it. Our relationship is not anyone's business. Why not be transparent about selling the package? Or attempting to do so? > Chinese developers have contributed more to this repository than anyone from the Koa organization. This kind of racial scaremongering or guilt by association is not acceptable. Its offensive. Nic…

[deleted]

Re: Tell HN: Node.js koa-router package transferred to unknown user

#30

Post by niftylettuce »

fireattack wrote: post #10
niftylettuce wrote: post #9

To anyone reading this, I'm building a tool to automate this nonsense, at least until Node/NPM do something about it. Email me at niftylettuce@gmail.com if you want to get notified once it's up. It will be free and open-source.

>automate this nonsense What exactly are you automating? A notification system for transferring of ownership?

Everything related to this nonsense
Post reply on HN