News for hackers. Stuff that matters.

A comment on What NPM should do to stop a new colors attack. Parent comment

Re:What NPM should do to stop a new colors attack by saghm on Monday January 10, 2022 @08:27PM (#29885890)
I mean, for almost every mainstream open source license, the answer to that is a pretty definitive "yes, they can", right? The most stringent of them require things like attribution and open source the modifications, neither of which seem like requirements that Github/NPM would have any qualms with following.
[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by xvector on Monday January 10, 2022 @08:53PM (#29886164)
But does GitHub/NPM have the right to modify his code and publish it under his account/his name? I doubt that is legal.
[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by jffry on Monday January 10, 2022 @09:29PM (#29886552)
The MIT license doesn't require NPM to list marak as the publisher of the NPM package, as long as they still obey the license's requirements.

Besides, the NPM Terms of Service are almost certainly broad enough to permit NPM to publish a modified version of a package or to delete a package.

[ Parent | on HN ]