ESLint compromised, may have stolen your credentials

Re:ESLint compromised, may have stolen your credentials by jessaustin on Thursday July 12, 2018 @04:27PM (#17518333)

I always thought it was a little weird for credentials to be put into .npmrc, and this isn't the first time this has caused a problem. Lots of people host their dotfiles publicly, but if you do that with .npmrc you'll (eventually) get an admonishing email from github etc. It really conflicts with the (correct, again) Unix model of separating configuration data from ephemeral data. The creds should be placed in $XDG_CACHE_HOME/npm/ , a directory that already contains lots of ephemeral data for npm. Incidentally that directory and its subdirectories seem to be world-readable by default, which is also stupid.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by AgentME on Thursday July 12, 2018 @06:57PM (#17519312)

It's not obvious to me that credentials are ephemeral data rather than part of the configuration.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by jessaustin on Thursday July 12, 2018 @10:05PM (#17520032)

From TFA:

npm has revoked all access tokens issued before 2018-07-12 12:30 UTC.

If credentials were configuration, we'd be screwed now, because the data we have stored is no longer valid. Fortunately, all we have to do is this:

  $ npm adduser

Now the data we have stored is correct again! This is textbook ephemeral data. We can cache it, and that might save some time, but it really doesn't matter. We could flush cache every half hour and it wouldn't hurt a thing.

Another way to see that credentials aren't configuration is what I suggested above: we would never want to back up or publish them, so they are different from and belong in a different place than configuration that we definitely want to back up and often want to publish.

[EDIT:] If one had only considered this from a "12-factor" perspective, in which creds and config are both called config and are both stored in envvars, I could understand the confusion. Note however that the config we're talking about for npm is e.g. "init-author-email". That doesn't change from environment to environment, so it's more like what 12-factor would call code...

[ Parent | on HN ]