Re:NPM debug and chalk packages compromised
by cgijoe on Monday September 08, 2025 @01:38PM
(#45171275)
Sorry, I am unfamiliar with ripgrep. Is this simply scanning for the string `_0x112fa8`? Could we do the same thing with normal grep -r?
[ Parent
| on HN ]
Re:NPM debug and chalk packages compromised
by skrebbel on Monday September 08, 2025 @01:41PM
(#45171316)
yes. ripgrep just does it faster, is all.
Re:NPM debug and chalk packages compromised
by hinkley on Monday September 08, 2025 @03:58PM
(#45173163)
Make it work, make it right, make it fast.
For security checks, the first 2 out of 3 is just fine.
Re:NPM debug and chalk packages compromised
by Aeolun on Monday September 08, 2025 @05:35PM
(#45174327)
Sure, but if you can get the last for free, why not?
Re:NPM debug and chalk packages compromised
by nothrabannosir on Monday September 08, 2025 @04:56PM
(#45173857)
But also respects .gitignore by default so I’m not sure you want to use ripgrep to scan your node_modules
Re:NPM debug and chalk packages compromised
by Fishkins on Monday September 08, 2025 @05:09PM
(#45174032)
For others who didn't know, the -u flag in the OP's command makes it so ripgrep _will_ search files even if they're gitignored
Re:NPM debug and chalk packages compromised
by postalcoder on Tuesday September 09, 2025 @01:54AM
(#45177926)
-u searches through ignored files
-uu searches through ignored and hidden files (eg dotfiles)
-uuu searches through ignored, hidden, and binary files (ie everything)
Re:NPM debug and chalk packages compromised
by AkshatJ27 on Monday September 08, 2025 @05:12PM
(#45174067)
Isn't the intended behaviour of original comment checking the node_modules folder for the "infected" string.
Re:NPM debug and chalk packages compromised
by EasyMark on Monday September 08, 2025 @01:42PM
(#45171334)
AI says this
The command rg -u --max-columns=80 _0x112fa8 uses the rg (ripgrep) utility. Here's a breakdown of what each part does:
rg: This is the command for ripgrep, a fast, recursive search tool that respects .gitignore and searches files for a given pattern.
1
-u: This flag tells ripgrep to search files that have been ignored by default (e.g., those listed in .gitignore).
1
--max-columns=80: This option sets the maximum width of a line to 80 characters. If a line exceeds this width, ripgrep will replace it with a message indicating that a matching line was removed, rather than displaying the full, long line.
1
_0x112fa8: This is the pattern that rg will search for within the files. It appears to be a hexadecimal string.
Re:NPM debug and chalk packages compromised
by naikrovek on Monday September 08, 2025 @03:20PM
(#45172662)
I feel like you were trying to help here, but anyone can do this for themselves. Providing information in this way sort of indicates that you don't believe that the person you're replying to can do it on their own, and for that reason it's considered rude.
Re:NPM debug and chalk packages compromised
by skygazer on Monday September 08, 2025 @05:14PM
(#45174080)
Also, HN hates machine generated replies, especially the lengthy and overly verbose slop variety -- I think that probably eclipsed any perceived rudeness.
Re:NPM debug and chalk packages compromised
by tbossanova on Monday September 08, 2025 @09:03PM
(#45176176)
I see what you mean, but I actually think there is a place for copy/pasting AI responses. I think of it as a kind of cache, surely a HN comment being served to n users means less resources used and faster access than if all n did their own AI query. But then of course you don’t get exactly your preference e.g. you might prefer a terser response than what is pasted here. Interesting to see how the etiquette around this plays out over time.
Re:NPM debug and chalk packages compromised
by vasco on Tuesday September 09, 2025 @01:11AM
(#45177657)
If you ever wanted to share an AI response, you probably should share your prompt, not the response. But likely you should not share anything, for the reasons already explained. Your argument about saving energy makes zero sense if you have any understanding of orders of magnitude but I won't share what AI says about it.
Re:NPM debug and chalk packages compromised
by tbossanova on Tuesday September 09, 2025 @09:58PM
(#45192166)
Ironically you are being incredibly rude trying to support an argument that posting AI responses is rude. I guess we can conclude you know nothing about anything.
Re:NPM debug and chalk packages compromised
by vasco on Wednesday September 10, 2025 @01:03AM
(#45193500)
I never mention rudeness, I dont give a shit about random people online being "rude". It's just something I don't like, so I shared my opinion.
Re:NPM debug and chalk packages compromised
by tbossanova on Wednesday September 17, 2025 @11:41PM
(#45285071)
Still ironic. Just so you know I might have considered what you said and changed my mind, but being rude made me dismiss you immediately. Just sharing my opinion