[Potential Drama] :marseykingcrown: adds malicious code to over 35k GitHub repos

https://twitter.com/stephenlacy/status/1554697077430505473
88
Jump in the discussion.

No email address required.

Any JS developer who isn't using locked NPM package.json versions in 2022 deserves to be hacked by Russians

Every smart dev I know did this 2yrs ago when the state of this NPM shit came to light

Edit: rDrama doesnt even use NPM, they download .js libraries like its 2007 https://github.com/Aevann1/rDrama/tree/frost/files/assets

Jump in the discussion.

No email address required.

>Every smart dev I know did this 2yrs ago when the state of this NPM shit came to light

Have you only been working for 2 years because lock files in node land have been around for 6 years.

Even before then the secure way was always either a custom registry or checking node modules into source control.

Jump in the discussion.

No email address required.

I’m not talking about lock files, I mean locking down version numbers.

A lock file wouldn’t do anything to help here anyway?

And I’ve been doing it for over a decade and I’ve seen so many open source projects that still use tildes for every package version number. This is a behavioral change not a tech change.

Jump in the discussion.

No email address required.

>rDrama doesnt even use NPM, they download .js libraries like its 2007

When we say we want the Internet to go back to 2007 we mean it.

:!marseykneel: :marseycapychad2: :marseykneel:

Jump in the discussion.

No email address required.

Kings

Jump in the discussion.

No email address required.

I love typoescript but hate this npm shit, is there any way for me? :(

Fixed typing is just so much more convenient to find bugs early

Jump in the discussion.

No email address required.

Learn rust

Jump in the discussion.

No email address required.

Lmao

Jump in the discussion.

No email address required.

NPM is bloated

Jump in the discussion.

No email address required.

Rails bundler and a bundled of other package managers have the same risks.

The problem is mostly how js encourages a thousand small dependencies each for single line code blocks.

Jump in the discussion.

No email address required.

I am a wannabe codecel so I am genuinely curious: is a locked npm version when you don't use tilde or caret range?

Jump in the discussion.

No email address required.

Yep

Jump in the discussion.

No email address required.

Lol javascript development is such a joke

Jump in the discussion.

No email address required.

how does a lock file help in this case r-slur

Jump in the discussion.

No email address required.

With a fixed version number you’re not going to download these exploits unless you explicitly change the version number in your package.json.

Otherwise any dev on your team who does npm install is at risk of installing any new minor package version update

Jump in the discussion.

No email address required.

these are forks not the original packages

Jump in the discussion.

No email address required.

Link copied to clipboard
Action successful!
Error, please refresh the page and try again.