News for hackers. Stuff that matters.

A comment on Malicious code in the purescript NPM installer. Parent comment

Re:Malicious code in the purescript NPM installer by littlestymaar on Monday July 29, 2019 @06:24AM (#20553093)
> Also, would there be a pointer built in that let you know about the new owner namespace when you try to upgrade automatically?

And what would be the point of the namespace then ?

[ Parent | on HN ]
Re:Malicious code in the purescript NPM installer by davnicwil on Monday July 29, 2019 @06:41AM (#20553148)
> pkg upgrade @person-a/some-package

"You're on the latest version 1.2.3 of @package-a/some-package, however @person-a has officially transferred ownership of some-package to @person-b and there is a newer version 1.2.4 available at @person-b/some-package. If you'd like to upgrade, please update your dependency to @person-b/some-package"

[ Parent | on HN ]
Re:Malicious code in the purescript NPM installer by littlestymaar on Monday July 29, 2019 @07:19AM (#20553337)
That's the mechanism, I was asking about the benefit of namespace in that case. With this kind of ownership transfers you lose all the alleged security benefit of namespaces.
[ Parent | on HN ]
Re:Malicious code in the purescript NPM installer by davnicwil on Monday July 29, 2019 @08:40AM (#20553934)
I think we're asking the same thing, or I've not explained well. I'm saying when ownership transfers, it'd be good to keep all the existing version history on the original namespace, exactly so you're not forced to update all your dependencies in case you don't need to upgrade and/or don't want the updates of the new owner.
[ Parent | on HN ]