What NPM should do to stop a new colors attack

Re:What NPM should do to stop a new colors attack by naikrovek on Monday January 10, 2022 @08:41PM (#29886017)

is it his right? to sabotage downstream code in revenge for not being paid for work he willingly took on knowing full well that he may never be paid?

legality is defined at the behest of societal needs. if society says something legal should be made illegal, or vice versa, then it will be.

GitHub/Microsoft chose to do the right thing for the society in the short term. in the long term, choosing a less stupid library update policy will benefit everyone AND let authors do all the "non-harmful" malevolent stuff they want.

as if this wasn't a single-point denial of service attack...

we are slowly (far too slowly) learning that our assumptions that all developers are benevolent is incorrect, and it's going to take another 2-5 instances of this kind of attack before people really start to understand why and see the danger of simply using libraries at all; especially in ecosystems like NPM where almost no one writes a single line of code on their own if it can instead be pulled in as a library dependency. this attitude is the exact opposite of a secure code approach and until people learn this, and learn it well, this kind of attack will continue, and the time between the attacks will gradually shorten.

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by heavyset_go on Monday January 10, 2022 @09:17PM (#29886421)

> to sabotage downstream code in revenge for not being paid for work he willingly took on knowing full well that he may never be paid?

Some consumers of his project chose to use his 3rd party dependency in their code for free knowing full well that it could disappear or break at any time, and yet they still chose not to mitigate those risks they chose to take on.

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by naikrovek on Monday January 10, 2022 @10:42PM (#29887211)

yes, that is the other half of the coin: don't run code if you don't know what it does.

an extreme version of that: don't use libraries at all.

I am trending more and more to this extreme as I age, because people aren't learning their lesson, and the npm ecosystem keeps biting them over and over...

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by chaostheory on Monday January 10, 2022 @09:25PM (#29886511)

"we are slowly (far too slowly) learning that our assumptions that all developers are benevolent is incorrect, and it's going to take another 2-5 instances of this kind of attack before people really start to understand why and see the danger of simply using libraries at all"

I agree, but at the same time if we had this mindset earlier; open source probably wouldn't have caught on as quickly. Maybe it wouldn't have become mainstream?

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by seoaeu on Tuesday January 11, 2022 @12:29AM (#29887946)

Honestly, it is kind of surprising we've gotten this far assuming that basically all open source maintainers aren't malicious

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by raesene9 on Tuesday January 11, 2022 @03:26AM (#29888974)

Unfortunately I don't think that 2-5 instances of this will produce any change.

We've seen more than that number of actual malicious package takeovers in the last couple of years and it has produced basically no real change.

heck I did a talk describing this kind of attack 6 years ago and I found prior instances when researching that talk...

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by xvector on Monday January 10, 2022 @08:52PM (#29886155)

Should your users have control over the code you publish under your name?

Because that is the precedent we are setting here.

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by fault1 on Monday January 10, 2022 @11:14PM (#29887454)

Did he own this code? Colors.js had plenty of other contributors, and there was no CLA involved.

github user "DABH" actually had more lines of code than marak did: https://github.com/Marak/colors.js/graphs/contributors

npm and github both have terms of service that you agree to when you choose to distribute something over those systems. npm in particular has had a long policy of unrolling malicious changes to the registry of packages ever since left-pad.

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by yifanl on Tuesday January 11, 2022 @05:26AM (#29889710)

If the responsibility lies with the maintainer, then the responsibility lies with the maintainer.

[ Parent | on HN ]