Hacker News Reader

Comment by dboreham | Hacker News Reader

The underlying story is here : https://github.com/dominictarr/event-stream/issues/116

Below is the scariest part in this story:

"@dominictarr Why was @right9ctrl given access to this repo?"

Response: "he emailed me and said he wanted to maintain the module, so I gave it to him. I don't get any thing from maintaining this module, and I don't even use it anymore, and havn't for years. note: I no longer have publish rights to this module on npm."

https://github.com/dominictarr/event-stream/issues/116#issue...

The same thing happened to gorhill and uBlock/uBlock Origin.

The takeaway seems to be that you should do a background check on anyone asking to become maintainer of your software.

With that said, this thing seems to have blown up because many large companies (Microsoft included) appear to use or depend upon this package. If none of these companies can lend 15 minutes of their engineers' time to help maintain the free software that they leverage, I can certainly understand the author's desire to let the module's maintenance become someone else's problem.

Indeed, the author of this package is not at fault here. It is the responsibility of the users depending on this package to check in all their dependencies and ensure to have reproducible builds.

I think many maintainers would have done the same.

That is just not realistic for most people. Maybe big corps can make that, but even basic things seems to download hundreds of megabytes of dependencies and I could just read for months before I would even start to develop.

I for sure miss old times when I got .Net framework, maybe some library from 1 or 2 3rd party vendors and I had all I needed for development.

While there's plenty of blame to go around, I have a gut feeling this isn't the last time we'll see something like this. A little malicious social engineering is all it takes to affect millions of people, apparently.

If you're developing something dealing with sensitive info (like, say, something processing cryptocurrencies) and you can't audit your codebase then you shouldn't be doing it in the first place frankly.

Of course in this case this is made worse by the fact that Javascript is so under-featured by default that you have to pull a ridiculous amount of dependencies to do anything which makes it a lot harder to audit everything. Besides since the language is so dynamic it's easy to write a very small, very powerful "shellcode" that can hook itself up anywhere in the software stack.

I'm not familiar with the Node ecosystem but people blaming the maintainer for giving control of one of his unmaintained repos to a third party is frankly ludicrous to me. I mean, why did you even trust the original maintainer in the first place? How do you know that if somebody had decided to pay him a million dollar to backdoor his package, he wouldn't have done it? Did you pay a private eye to conduct a private investigation on them?

If the other dev who injected the backdoor had waited a year or so, pretending to actually maintain the package first, what then?

If you're writing code dealing with sensitive information (say, credit card, cryptocurrency credentials, private information etc...) and you don't even bother to vet your dependencies and when it blows in your face your first reflex is to shift blame on some guy who's giving your source code free on the internet you should really think hard about what you're doing.

Can you imagine that flying in any other industry? "Bridge collapses because company bought crappy steel from some guy off e-bay, but hey he had a trustworthy nickname."

I mean, the injection was finally discovered because of a deprecation warning: https://github.com/remy/nodemon/issues/1442

I wonder how many backdoored node packages there are out there, but judging by how this issue was handled I'd guess probably more than 0.

If there's one positive consequence to this cryptocurrency craze it's that it shines light on our terrible so-called "engineering" practices in the software industry.

Reply on news.ycombinator.com