What NPM should do to stop a new colors attack

Re:What NPM should do to stop a new colors attack by zdragnar on Monday January 10, 2022 @10:36PM (#29887154)

aws-cli, a tool which provides access to an absurd amount of resources (compute, storage, text messaging to name a few) relies on "community expectation of semver-ish adherence" for security and continual operation, and I'M the one gaslighting people?

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by acdha on Monday January 10, 2022 @10:50PM (#29887296)

You meant CDK (aws-cli is written in Python) but it’s not that simple: they shipped a lock file which pinned 1.4.0 but while NPM honors that the popular yarn package manager does not:

https://github.com/aws/aws-cdk/issues/18322#issuecomment-100...

This floating behavior allowed for it to be overridden locally:

https://github.com/aws/aws-cdk/issues/18322#issuecomment-100...

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by zdragnar on Tuesday January 11, 2022 @12:34PM (#29894661)

Ah yes, the classic "you're holding it wrong" defense.

[ Parent | on HN ]