News for hackers. Stuff that matters.

A comment on What NPM should do to stop a new colors attack. Parent comment

Re:What NPM should do to stop a new colors attack by acdha on Monday January 10, 2022 @05:33PM (#29883814)
I don't know what makes you want to try to gaslight people on marak's behalf but this is a pretty poor attempt at doing so. He published a deliberately broken update with a non-breaking version number change to a package management ecosystem where the community expects to follow a semver-ish model where point updates do not break things. This is an abuse of trust, just like it would be if you said “I'm tired of cooking for everyone so I'm going to spit in the soup before serving it”.
[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by kwinten on Monday January 10, 2022 @05:52PM (#29884093)
But you didn't have to go to that restaurant! Don't you do a full health and safety inspection of every restaurant you visit (and of their entire supply chain)?
[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by edoceo on Monday January 10, 2022 @06:05PM (#29884285)
Up-thread there is a comment that the Major on the semver was updated. Which is correct? Was it Major or Patch number?

Edit to Add: According to this page https://www.npmjs.com/package/faker

The previous version was 5.x.y and the endgame version was 6.6.6

So, which tools defaulted to magically bumping the dependency from 5.x.y to the 6.x.y? Seems like jumping a major shouldn't automatically happen.

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by acdha on Monday January 10, 2022 @06:09PM (#29884345)
I'm not sure what they said specifically but https://security.snyk.io/vuln/SNYK-JS-COLORS-2331906 and https://snyk.io/advisor/npm-package/colors show that the version went from 1.4.0 to 1.4.1.

Edit: your comment makes more sense now that I see it was talking about faker.js.

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by zdragnar on Monday January 10, 2022 @10:36PM (#29887154)
aws-cli, a tool which provides access to an absurd amount of resources (compute, storage, text messaging to name a few) relies on "community expectation of semver-ish adherence" for security and continual operation, and I'M the one gaslighting people?
[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by acdha on Monday January 10, 2022 @10:50PM (#29887296)
You meant CDK (aws-cli is written in Python) but it’s not that simple: they shipped a lock file which pinned 1.4.0 but while NPM honors that the popular yarn package manager does not:

https://github.com/aws/aws-cdk/issues/18322#issuecomment-100...

This floating behavior allowed for it to be overridden locally:

https://github.com/aws/aws-cdk/issues/18322#issuecomment-100...

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by zdragnar on Tuesday January 11, 2022 @12:34PM (#29894661)
Ah yes, the classic "you're holding it wrong" defense.
[ Parent | on HN ]