Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

271–280 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#271

Post by greatgib »

It's fun, because a few years ago, serious software engineers in serious companies, were always hosting their own copy of all the dependencies that were used.

In the worst case scenario, using 'stable' versions of Linux distributions like Debian.

But, in recent years, the trend was the one of young incompetent hipster devs: it is has been to not use the very last version of everything, and especially if we can get it directly from random sources on the internet.

This is especially true with npm/js and go developers.

It is not like no one tried to tell them and teach them about that, but they can't or won't understand...

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#272

Post by dagmx »

fxtentacle wrote: post #261
notRobot wrote: post #21

Here's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't…

In my opinion, golang does this correctly. You can just git submodule the source code of your dependencies. That way, you're always in control over what gets updated and when.

That's true of most package managers too though. It's very trivial to vendor the code yourself in both NPM and Cargo for example.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#273

Post by mulmen »

IceDane wrote: post #202
starkd wrote: post #175

Earlier quoted context omitted.

I couldn't help but think the same thing. Seems like an incredibly immature way to handle it. He could have easily set an end date and state nothing will be maintained beyond that date. It's not a good look.

I don't think he cares at this point. I think this is a person that has been driven to the absolute end of their patience. If he's really barely been getting by, then I can only imagine the sheer frustration he must be feeling. Not only are there swathes of fortune 500 companies which depend on his package but don't contribute a dime, but he also had a company with millions of dollars in funding look at his idea and…

It seems completely insane to me to give away work and then expect compensation for it.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#274

Post by stickfigure »

oblio wrote: post #60
heluser wrote: post #43

Earlier quoted context omitted.

To resolve such issues the central maven repo, for example, makes artifacts immutable when you publish them

Quoted post unavailable.

You've run afoul of https://en.wikipedia.org/wiki/Poe%27s_law

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#275

Post by jay_kyburz »

tailspin2019 wrote: post #95
evolve2k wrote: post #30

Earlier quoted context omitted.

Actually in attempting to answer my own question, on other platforms like YouTube and Medium, popular content receives monetary support by virtue of being popular. What if this was addressed at the “platform” level, I’m thinking the package manager here, NPM. If npm had paid plans that would essentially mop up larger corporations they could then auto-distribute funds Spotify style based on “number of listens”. I’d pe…

> If npm had paid plans that would essentially mop up larger corporations they could then auto-distribute funds Spotify style based on “number of listens”. This seems like a pretty decent idea…

Or they could just pay people to develop and maintain a batteries included standard library and just throw away 99% of packages.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#276

Post by bdcravens »

bastardoperator wrote: post #108

Should I get paid for my multiple contributions to faker (I don't think I should)? I've submitted several PR's for generating data all of which were accepted. Even back then the maintainer was barking about money... Honestly the project would be better off forked. He did not write this library entirely by himself, at this point I just see him as holding other committers contributions as hostage. It's a bad look, why…

Not to mention the fact that this is just a port of faker from Ruby and Perl (from last version's README, "faker.js was inspired by and has used data definitions from ...")

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#277

Post by bogwog »

sillysaurusx wrote: post #195
joshuaissac wrote: post #117

GitHub has now suspended the maintainer: https://nitter.net/marak/status/1479200803948830724

This is scary, and I don’t know why people here aren’t losing their minds. I think someone should make a big deal about this. What would be the first step? On the other hand, my GitHub was once suspended (and all repos shuttered) for posting gists that looked like spam to some algorithm. It was extremely unsettling, and they need to do a better job communicating. But they may have suspended the account because they t…

Why is that scary? If you do bad things, you're going to get banned. This guy abused Github to distribute malicious code to thousands of projects.

If losing your Github means losing your projects, that's on you for being lazy/irresponsible with them. Git is already decentralized, and anything important should be cloned on something you own.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#278

Post by qaq »

IceDane wrote: post #268
qaq wrote: post #233

Earlier quoted context omitted.

what idea?

https://web.archive.org/web/20210628030444/https://marak.com...

still confused faker.js is in no way an original project, ruby faker is 4 years older than faker.js and I doubt it's the oldest.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#279

Post by e1g »

capableweb wrote: post #36

Doesn't it seem strange that Snyk is creating a vulnerability report for this + labeling it a DoS? DoS is something someone executes against a target, in this case a package had it's functionality (purposefully) altered. That's like calling changing the API of a popular library DoS, because now application authors need to change their code/use a different library... Fittingly enough, all four solutions for this parti…

DoS is just Denial of Service - he published a patch update that removes all functionality with specific intent to break the application that uses his code. His action, and this version of the library, is literally an attack on your application and "Denial of Service" is the only goal.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#280

Post by ahiknsr »

superkuh wrote: post #149
joshuaissac wrote: post #117

GitHub has now suspended the maintainer: https://nitter.net/marak/status/1479200803948830724

I don't understand why. It's his code to break if he wants. But I guess when you use a social media service to host your code these are expected and normal results.

> It's his code to break if he wants

> I don't understand why

If he can break his code because he is the owner then shouldn't the same reasoning apply for Github suspending the account?. It is their website and their rules. Keep in mind Github owns npm and the author has published a malicious package to npm which has 20 millions of downloads so I'm not surprised.

Post reply on HN