News for hackers. Stuff that matters.

A comment on What NPM should do to stop a new colors attack. Parent comment

Re:What NPM should do to stop a new colors attack by jffry on Monday January 10, 2022 @09:32PM (#29886572)
I do not think NPM altered a package, they unpublished the nonfunctional/infinite-loop version, so that the prior, functional, version (pushed by marak) becomes the "latest" version again
[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by gigel82 on Monday January 10, 2022 @11:18PM (#29887471)
Yes, that is a very dangerous precedent. This isn't like the leftpad issue where someone stole credentials from the project owner. This is the project owner himself publishing a new version of his project.
[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by fault1 on Tuesday January 11, 2022 @12:10AM (#29887838)
Nobody stole creds off the project owner in the left-pad incident. npm chose the needs of the many rather the few in that incident: https://twitter.com/seldo/status/712417370686365697

which seems like very much akin to what they are doing now.

[ Parent | on HN ]