Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

Post by hsbauauvhabzb » Mon, Jan 10, 2022, 12:53 AM UTC

ratorx wrote: post #221

pc86 wrote: post #179

Earlier quoted context omitted.

Are these really RCE vulnerabilities? Looking at it systematically I only see this as an RCE vector if you're doing one or more things very wrong. This assumes that packages are immutable and an author can't update a version that's already there. This is how NuGet works, and IMO is how any remotely sane package manager will work. There's no reason for a version to be mutable in this context. Pegging to a specific ver…

The tool should take some blame here. I agree that it’s ultimately the developers fault for allowing code to be automatically injected from not fully trusted sources on minor updates, but the package manager makes it way too easy to do. For example, when I npm install a package, it defaults to specifying a semver compatible version in package.json, rather than doing the secure thing and pinning a version. But whether…

Post by giaour » Mon, Jan 10, 2022, 12:56 AM UTC

hnick wrote: post #326

xg15 wrote: post #237

Earlier quoted context omitted.

Transitive dependencies are also your dependencies, even if you didn't consciously include them. So in an ideal world, you should vet all changes to dependencies of your codebase, including transitive dependencies. Whether or not this would be compatible with the way dependencies are used today is another question.

I'm not even sure it's not a fool's errand with the current software ecosystem. I think at some point it will have to be a language level feature. The ability to sandbox or provide permissions to packages/functions. Just like our OS had to, just like browsers had to, just like phones had to. Our code is the platform, the packages the apps. It's a similar use case. If I could download a module, and tell the compiler t…

Post by Dylan16807 » Mon, Jan 10, 2022, 12:57 AM UTC

shukantpal wrote: post #208

melony wrote: post #134

Earlier quoted context omitted.

That's fine, but then the downstream shouldn't complain either when the code breaks, whether intentionally or unintentionally. The contract on paper disclaims all liability after all. There is a social contract and then there is the literal contract. A lot of commenters here seem to be willfully obtuse or simply ignoring the former.

> That's fine, but then the downstream shouldn't complain either when the code breaks, whether intentionally or unintentionally. There's no contract that says complaining is banned.

Post by throwthere » Mon, Jan 10, 2022, 12:59 AM UTC

Comevius wrote: post #2

GitHub suspended access to their account for a commit to their own software, because it caused a problem for all these companies. For one it shouldn't have, like pinning a dependency and auditing all changes should be done ideally. These libraries are always licensed in a way that excludes warranty of any kind. But I honestly don't care if companies "exploit" open-source software by making money using them and not do…

Post by sydthrowaway » Mon, Jan 10, 2022, 1:01 AM UTC