Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM package compromised by author: erases files on RU / BY computers on install

snyk.io

Post reply on HN
Print view View original

81–90 of 188 posts

Re: NPM package compromised by author: erases files on RU / BY computers on install

#81

Post by urthor »

chizhik-pyzhik wrote: post #6

Regardless of your political position, this falls well within the definition of malware. It's irresponsible for the maintainer to allow this: https://github.com/RIAEvangelist/node-ipc/issues/233

This still goes to the heart of the obligations of maintainers.

"THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE."

People keep placing obligations on maintainers in the FOSS ecosystem.

Maintainers don't have to do jank in this situation, except don't fraudulently distribute their software.

If they want to publish their upstream as malware, okay.

It's the end user's fault for continuing to pull that source code and integrate it into their system.

Re: NPM package compromised by author: erases files on RU / BY computers on install

#82

Post by JonChesterfield »

Comments seem split between "that's illegal, beware the lawyers" and "don't RCE yourself then cry about it".

I've got some bash scripts on GitHub that would delete files on the local machine if run. Today I don't care if anyone else runs them. If however the winds are blowing towards people doing themselves harm with my code is my problem, I guess I should delete the code I've published.

Bad precedent to see here.

Re: NPM package compromised by author: erases files on RU / BY computers on install

#83

Post by jddil »

asats wrote: post #78
jddil wrote: post #73

Earlier quoted context omitted.

Quoted post unavailable.

You do understand you are talking about real people? Young girls, parents of toddlers, grandmas? Why do you think _you_ have the right to tell them to go face possible death and torture?

Are the Ukrainians not real people? Young girls, parents of toddlers are getting killed right now by Russians and we are excusing not protesting this cause they may get in trouble, nah that's not ok.

Re: NPM package compromised by author: erases files on RU / BY computers on install

#84

Post by ctvo »

Isthatablackgsd wrote: post #44
celticninja wrote: post #36

Earlier quoted context omitted.

I don't see any issue for the developers at all. It is their software to create and alter as they see fit. End users choose to use the package, it is not being installed on their machines without their knowledge.

Four things: 1) Why they changed the code all of the sudden? If they are fine with realeasing this kind of damaging payoad, then why they decided to change the code? I mean they want to make a statement, right? Then they should leave the original code and stand by it. Why they are not standing by their statement? 2) Why RIAEvangelist editing people comments to minimize their languages? why they are censoring their co…

No post body was provided.

Re: NPM package compromised by author: erases files on RU / BY computers on install

#85

Post by octoberfranklin »

Houshalter wrote: post #80

I love the idea we will soon have western and eastern open source projects. Even if internet isn't bifurcated, both sides will be too paranoid to install software from the other side. All software projects will have to pedantically vet every line of a commit, photo ID every contributor, to avoid subtle bugs intentionally committed and sent to millions. Why stop at countries? How hard would it be to use ML to detect i…

> photo ID every contributor

If the Western FOSS ecosystem demands KYC from me I'm dumping them for the Non-Aligned Movement.

Re: NPM package compromised by author: erases files on RU / BY computers on install

#86

Post by bryanrasmussen »

urthor wrote: post #81
chizhik-pyzhik wrote: post #6

Regardless of your political position, this falls well within the definition of malware. It's irresponsible for the maintainer to allow this: https://github.com/RIAEvangelist/node-ipc/issues/233

This still goes to the heart of the obligations of maintainers. "THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWI…

>If they want to publish their upstream as malware, okay.

I think you'll find that argument will not be very persuasive to a judge if the case is that the author of the software knowingly adds code in after people have integrated it into their systems that on purpose damages those systems.

Intention will often carry weight, and no claiming of rights and purity and see I wrote here you can't do anything to me! is going to persuade a judge that you can just go around destroying property because you want to.

Re: NPM package compromised by author: erases files on RU / BY computers on install

#87

Post by ComputerGuru »

slim wrote: post #52

This is crazy. Are you hating on every Russian now ? Nobody is chocked by how anger against the the russian state shifted to hate against russian people ?

It’s straight out of 1984 groupthink. We have always been at war with Eurasia, they are the enemy.

Re: NPM package compromised by author: erases files on RU / BY computers on install

#88

Post by jddil »

azornathogron wrote: post #77
jddil wrote: post #73

Earlier quoted context omitted.

Quoted post unavailable.

In London, in 2002, there were big protests against the imminent war in Iraq. According to Wikipedia, "an anti-war rally in London drew a crowd of at least 150,000". The UK is, nominally at least, a democracy. It's certainly a place where protesters are at much less risk than protesters in Russia. But after the protests we still invaded Iraq. I support Ukraine 100%. I'm glad the UK and EU and US are sending weapons a…

No post body was provided.

Re: NPM package compromised by author: erases files on RU / BY computers on install

#89

Post by armchairhacker »

urthor wrote: post #81
chizhik-pyzhik wrote: post #6

Regardless of your political position, this falls well within the definition of malware. It's irresponsible for the maintainer to allow this: https://github.com/RIAEvangelist/node-ipc/issues/233

This still goes to the heart of the obligations of maintainers. "THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWI…

Normally I agree, except in this case when the maintainer becomes the aggressor and literally installs malware to the user. This has nothing to do with FOSS and contributors being obligated to write better code, this is deliberately hacking someone.

That's like saying "it's your fault for giving them your password" when someone opens a phishing link. Yeah, all the scammers did was host a website and send emails, you chose to provide them your information. It doesn't make them not liable.

Re: NPM package compromised by author: erases files on RU / BY computers on install

#90

Post by 88913527 »

urthor wrote: post #81
chizhik-pyzhik wrote: post #6

Regardless of your political position, this falls well within the definition of malware. It's irresponsible for the maintainer to allow this: https://github.com/RIAEvangelist/node-ipc/issues/233

This still goes to the heart of the obligations of maintainers. "THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWI…

> If they want to publish their upstream as malware, okay.

NPM's terms explicitly disallow malware. They're free to put the raw source on say GitHub, but the author isn't permitted to package and distribute it on NPM.

https://docs.npmjs.com/policies/open-source-terms

Post reply on HN