News for hackers. Stuff that matters.

A comment on What NPM should do to stop a new colors attack. Parent comment

Re:What NPM should do to stop a new colors attack by chaostheory on Monday January 10, 2022 @05:33PM (#29883809)
No one expects a maintainer to purposely break their project. If he wanted to end it, he should have just sent a goodbye message signaling the end of his involvement with maintenance. This has been done many times before without incident. If he wanted to be paid, he should have either picked the appropriate license for his software from the start, or just changed it for future versions. The latter has also been done before with SugarCRM being one example

To be fair, Marak seems to be mentally unwell right now, which helps explain but doesn't condone his behavior

https://abc7ny.com/suspicious-package-queens-astoria-fire/64...

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by heavyset_go on Monday January 10, 2022 @09:08PM (#29886329)
> No one expects a maintainer to purposely break their project.

If you're using a 3rd party dependency, especially one you aren't paying for, you should expect it to break or disappear at any time.

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by chaostheory on Monday January 10, 2022 @09:13PM (#29886369)
Falling into disrepair, or not being maintained due to various valid reasons: yes. This happens all the time.

Some asshole maliciously breaking your stuff: no.

I do not use either colorsjs or fakerjs. I was close since I used the Ruby version of faker that Marak ported into nodejs as fakerjs.

[ Parent | on HN ]