News for hackers. Stuff that matters.

A comment on NPM package compromised by author: erases files on RU / BY computers on install. Parent comment

Re:NPM package compromised by author: erases files on RU / B... by 88913527 on Wednesday March 16, 2022 @10:41PM (#30707026)
> If they want to publish their upstream as malware, okay.

NPM's terms explicitly disallow malware. They're free to put the raw source on say GitHub, but the author isn't permitted to package and distribute it on NPM.

https://docs.npmjs.com/policies/open-source-terms

[ Parent | on HN ]
Re:NPM package compromised by author: erases files on RU / B... by urthor on Saturday March 19, 2022 @09:04PM (#30739028)
You're spot on, my mistake.

I thought the author published it via Git and some npm maintainer scraped them.

If they distributed this code to end users that's just a cyberattack.

[ Parent | on HN ]