In a completely unrelated matter, Google search results quality has really declined in the last few years...
Out of curiosity, what did you remember about the link that you tried searching for? Do you remember when you last saw it?
[insert semicoherent hopium about ChatGPT as a magical panacea here]
I assume you tried punching in keywords like “fake NPM package hack” or something like that?
Edit: This was not meant to be read in a negative kind of way. I'd try to hire him if I had an open position to fit.
> Now I cannot leave Russia, because after the accident I have outstanding lawsuits in the amount of tens of thousands of dollars and I am forbidden to leave the country until they are paid off.
Interesting. I know a person who somehow emigrated from Russia last year with some debt and is paying it off. But perhaps there is some other condition I don't know about.
But anyway it would be more difficult to emigrate to another country long term with a criminal record, they always ask about it on visa applications. If I was more cynical I would think an evil government could use the carrot of forgiving his lawsuits in exchange for pushing some backdoors but I don't think this would go unnoticed
Very unfortunate situation to be in, though my sincere hate for reckless russian drivers I have seen a lot in my life makes it a bit difficult to sympathize.
... and living in a country involved in war, run by a regime for which respect for the rule of law is a "nice to have".
If I were in FSB, I'd be banging at this guy's door right now, and making his life as comfortable as I can. Imagine dropping an obfuscated killswitch on half the global web, that is Real Power right there; or silently siphoning out credentials from FAANG-level companies; or or or...
We are incredibly lucky that Herr Putin's henchmen are actually not very good.
window['__core-js_shared__'].versions
Just more evidence of how prevalent and important that library is.
I absolutely feel for his situation. Right now, the degree to which he could be threatened into allowing a malicious group to push changes in his name should not be taken lightly. Hopefully this article reaches the attention of some of the CISOs at companies who rely on the project, and a path towards a situation where multiple parties have visibility into release management can be explored. And honestly, such a solution might be the best thing to make Denis and his family less of a target.
(In the meantime, pin your core-js dependency, and track https://security.snyk.io/vuln/npm?search=core-js as well as npm audit. Arguably there should be an advisory category for known vulnerable maintenance situation - I'm not sure if such a registry exists. One might say that every open source project is vulnerable in some way, but there's nuance and splash radius to consider here, and core-js does not have much defense-in-depth at the moment.)