News for hackers. Stuff that matters.

A comment on What NPM should do to stop a new colors attack. Parent comment

Re:What NPM should do to stop a new colors attack by edoceo on Monday January 10, 2022 @06:05PM (#29884285)
Up-thread there is a comment that the Major on the semver was updated. Which is correct? Was it Major or Patch number?

Edit to Add: According to this page https://www.npmjs.com/package/faker

The previous version was 5.x.y and the endgame version was 6.6.6

So, which tools defaulted to magically bumping the dependency from 5.x.y to the 6.x.y? Seems like jumping a major shouldn't automatically happen.

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by acdha on Monday January 10, 2022 @06:09PM (#29884345)
I'm not sure what they said specifically but https://security.snyk.io/vuln/SNYK-JS-COLORS-2331906 and https://snyk.io/advisor/npm-package/colors show that the version went from 1.4.0 to 1.4.1.

Edit: your comment makes more sense now that I see it was talking about faker.js.

[ Parent | on HN ]