Crazy how many projects apparently depended on this library without pinning their versions.
Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
641–650 of 1001 posts
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#642Earlier quoted context omitted.
Crazy what happens when you decide to freeload off a stranger’s code who you have no contract or agreement with whatsoever, beyond a license you must accept to use the software which disclaims any warranty whatsoever, even fitness for any purpose. I have zero sympathy for anyone complaining they were hurt by this. I think Marak is teaching an important and principled lesson here.
> I think Marak is teaching an important and principled lesson here. What lesson is that?
No post body was provided.
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#643Earlier quoted context omitted.
"Abused Github to distribute malicious code" is a legal wording, not a EULA violation. A lawsuit, not an account ban. Let's decide how serious this is. Exactly. I am, for one, of the opinion that it is not at all serious. Not deserving of a lawsuit or an account ban. Not even newsworthy. I mean, this could easily become the new normal for OSS. You use it – you're not insured against anything, for there is no formal c…
no its a criminal act. crashing RANDOM servers that you DONT know what they do is not a protest.
Your argument could be used to describe any software defect, whether malicious or accidental. Open-source code is mostly not produced with any knowledge of downstream servers; that's the responsibility of the server owners. The software developers also have a responsibility to ensure they trust the author and are okay with the code they are importing into their own projects.
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#644I truly don’t understand trusting anything from a package manager. Download the code. Read through it. Then host it on your own server and manually include it. Anything else is pure insanity to me.
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#645Earlier quoted context omitted.
Not to mention the fact that this is just a port of faker from Ruby and Perl (from last version's README, "faker.js was inspired by and has used data definitions from ...")
"inspired" my ass. It's a fork, not keeping the licence terms. https://news.ycombinator.com/item?id=27254092
seems like he has a history of this (HN 2010):
https://news.ycombinator.com/item?id=1448309
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#646Maintainer of Chalk[0][1] here, a very popular alternative to colors. Happy to help anyone that would like to port away from colors to chalk, or who might just have general questions about terminal colors. Just reply here and I'll see them. [0] https://GitHub.com/chalk/chalk [1] https://npmjs.org/package/chalk
Not a question but just want to help developers who needs it: pkg.land (beta) finds similar packages on NPM.
Here are the links for colors and faker:
https://pkg.land/package/colors (chalk is top suggestion!)
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#647Earlier quoted context omitted.
Each version of the package comes with its own source code and license. It's your responsibility to audit new package versions before installing them. And that's what the author did, he published a new version. You can blame your tools and package.json for automatically updating, but at that point it's a self-inflicted injury.
I haven't actually checked if the README or description of the package was updated to reflect the new (malicious) behaviour of the code, but even if it was, I think that knowingly exploiting people's trust to stop their software working should be treated as evidence of hacking. It's like if you went to work one day with a spray can hidden in your jacket and started graffitiing the office walls, but justified your act…
Interesting questions. I don't know the answer and I believe even lawyers might have trouble with this.
I guess it would come down to 1) how technically savy is the user(is it a FAANG engineer or a grandma? is it expected from a FAANG engineer to look at the diffs when applying updates? Is a grandma expected to read the release notes?) and 2) how malicious is this code change?
Are the users updating the only ones wronged or first-time users too? Say you're installing a library for the first time. The library says it does A, you install it and realizes is does B, are you then allowed to sue the author? I guess it depends on how far A is from B and how malicious B is, but the author explicitly stated the code comes with no guarantees. Should anyone that installs "left-pad", but then realize the lib only does right-padding be able to successfully sue the author? The code explicitly comes with no guarantees! It seems very tricky and I'm not sure we can write deterministic black-or-white laws for this, but again, maybe I'm applying a higher standard based on SWE practices for other trades. As far as I know, the legal system is on the hands of politicians who write non-total functions and judges who interpret those functions as they wish.
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#648I feel like the “smart” move would have been to relicense and “GPL bomb” all the corporations. That would have negatively impacted exactly 0 users but probably caused every software company to actually fork or move to something else like the author originally requested. In the community it would have resulted in much more interesting discussion around software licensing and how to support package maintainers rather than just royally piss everyone off with punk behavior. Kids these days…
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#649Earlier quoted context omitted.
> Packages are literally remote code exec vulns in the hands of package authors Something mentioned in this article caught my eye: > While searching for Marak’s libraries, I found this npm-test-access library. This library seems to be used for what the name describes: to test access to NPM. Marak seems like a very capable software engineer, and it’s unclear to me why he’d need a package like this. So, this make me pe…
This seems like irresponsible speculation and insinuating that Marek is about to commit a felony? I’d rather skip the character assassination based on hypothetical future actions please, and focus on what’s actually happened.
> Packages are literally remote code exec vulns in the hands of package authors
There are 20m+ weekly downloads of the colors package alone. He has what amounts to remote execution privileges to people using that package. When the subject of compromised packages comes up and he’s demonstrated that he’s willing to publish malicious updates, it’s completely fair to wonder what else he’s willing to do with that level of access to that many systems. It’s irresponsible not to consider what his packages can do to your systems.
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#650I truly don’t understand trusting anything from a package manager. Download the code. Read through it. Then host it on your own server and manually include it. Anything else is pure insanity to me.
The problem with npm is that you'll have to read a LOT of transitive dependencies.
There is a reason why there is a large cottage industry doing security scanning of npm deps.
In the end it all depends on who you trust.