News for hackers. Stuff that matters.

A comment on What NPM should do to stop a new colors attack. Parent comment

Re:What NPM should do to stop a new colors attack by fault1 on Monday January 10, 2022 @11:14PM (#29887454)
Did he own this code? Colors.js had plenty of other contributors, and there was no CLA involved.

github user "DABH" actually had more lines of code than marak did: https://github.com/Marak/colors.js/graphs/contributors

npm and github both have terms of service that you agree to when you choose to distribute something over those systems. npm in particular has had a long policy of unrolling malicious changes to the registry of packages ever since left-pad.

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by yifanl on Tuesday January 11, 2022 @05:26AM (#29889710)
If the responsibility lies with the maintainer, then the responsibility lies with the maintainer.
[ Parent | on HN ]