I've Just Liberated My Modules

Re:I've Just Liberated My Modules by d0m on Tuesday March 22, 2016 @11:33PM (#11341959)

Hmm, how does that help?

  User A: Publish package X1.0 (with 2 factor auth)
  User B: Download with npm package X1.0
  User A: Unpublish package.
  User C: Publish package X1.0, malware code (with a different 2 factor auth)
  User B: Somewhere else, download and install package X1.0

For that to work, every package should be signed in package.js so that when you download a different version, you know about it. Also, I don't think it should be possible to alter previous versions. Package X1.0 should always be X1.0.

EDIT:

Seems like it's impossible to re-upload X1.0, which fix this issue. I thought once a package was unpublished, it was possible to republish the exact same version.

[ Parent | on HN ]

Re:I've Just Liberated My Modules by STRML on Tuesday March 22, 2016 @11:36PM (#11341973)

When a package transfers ownership or is removed/re-added, it's not possible to republish the same version as one that has previously existed.

Of course, this doesn't save you if you're installing `^1.0.0`, the maintainer deletes the package, and someone else uploads a malicous `1.0.1`.

The package.json should allow pinning publisher usernames and optionally public keys, and shrinkwrap should pin hashes, not just versions.

[ Parent | on HN ]

Re:I've Just Liberated My Modules by d0m on Tuesday March 22, 2016 @11:43PM (#11342002)

I edited my post while you were writing yours ;-) Thanks for the clarification.

[ Parent | on HN ]