News for hackers. Stuff that matters.

A comment on What NPM should do to stop a new colors attack. Parent comment

Re:What NPM should do to stop a new colors attack by acdha on Monday January 10, 2022 @10:50PM (#29887296)
You meant CDK (aws-cli is written in Python) but it’s not that simple: they shipped a lock file which pinned 1.4.0 but while NPM honors that the popular yarn package manager does not:

https://github.com/aws/aws-cdk/issues/18322#issuecomment-100...

This floating behavior allowed for it to be overridden locally:

https://github.com/aws/aws-cdk/issues/18322#issuecomment-100...

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by zdragnar on Tuesday January 11, 2022 @12:34PM (#29894661)
Ah yes, the classic "you're holding it wrong" defense.
[ Parent | on HN ]