News for hackers. Stuff that matters.

A comment on What NPM should do to stop a new colors attack. Parent comment

Re:What NPM should do to stop a new colors attack by rakoo on Tuesday January 11, 2022 @07:15AM (#29890599)
> People didn't actively go seek out a new version.

Yes, they did. Have you read the article ? That's how npm works: it always pulls the latest version.

You can't use tools you don't understand and blame someone else if it doesn't work as you expect it to.

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by PragmaticPulp on Tuesday January 11, 2022 @11:26AM (#29893562)
> Yes, they did. Have you read the article ? That's how npm works: it always pulls the latest version.

No, it pulls the specified version.

The affected packages fixed it by removing the leading carpet in the version specifier, which was designed to allow patch version bumps for things like security fixes.

He literally abused the versioning system designed to allow security fixes by introducing a breakage and disguising it as a non-breaking change.

[ Parent | on HN ]