Re:What NPM should do to stop a new colors attack
by jffry on Monday January 10, 2022 @09:32PM
(#29886572)
I do not think NPM altered a package, they unpublished the nonfunctional/infinite-loop version, so that the prior, functional, version (pushed by marak) becomes the "latest" version again
Re:What NPM should do to stop a new colors attack
by gigel82 on Monday January 10, 2022 @11:18PM
(#29887471)
Yes, that is a very dangerous precedent. This isn't like the leftpad issue where someone stole credentials from the project owner. This is the project owner himself publishing a new version of his project.
Re:What NPM should do to stop a new colors attack
by fault1 on Tuesday January 11, 2022 @12:10AM
(#29887838)
Nobody stole creds off the project owner in the left-pad incident. npm chose the needs of the many rather the few in that incident:
https://twitter.com/seldo/status/712417370686365697
which seems like very much akin to what they are doing now.
Re:What NPM should do to stop a new colors attack
by judge2020 on Monday January 10, 2022 @07:46PM
(#29885485)
They supposedly took over the npm packages[0,1], not the github.com repos. npm is a system where you push archives as package versions, it doesn't do its own pull from a github repo or otherwise.
To add, unused/squatted npm package names regularly get reassigned[2].
0: https://www.npmjs.com/package/colors
Is there more on this? This is the first I’ve heard about this npm package being modified which I would have just ignored as regular npm problems, but hearing that GitHub took over someone’s repo sounds crazy. Does their ToS claim to override copyright or something?