Hacker News Reader

Comment by lalaland1125 | Hacker News Reader

cdnjs will mirror any npm package

They didn't update any part of cdnjs itself. Instead, they triggered cdnjs on their package.

Do they? Their website https://cdnjs.com/libraries says "Couldn't find the library you're looking for? You can make a request to have it added on our GitHub repository."

Amusingly you can see the "hey-sven" library they added to test the fix: https://github.com/cdnjs/packages/pull/695

If you download the tarball directly, https://registry.npmjs.org/hey-sven/-/hey-sven-1.0.2.tgz, then tar -ztvf hey-sven-1.0.2.tgz, you can see

-rw-r--r-- 0 ryotak staff 204 Jun 2 16:21 package/package.json

-rw-r--r-- 0 ryotak wheel 10 Jun 2 16:21 ../../../../../../../../../../tmp/ryotak

-rw-r--r-- 0 ryotak wheel 10 Jun 2 16:22 ../../../../../../../../../../tmp/ryotak.sh

both which just have the contents "Retesting"

I'm just trying to find the root cause. I see that is PR is merged by a contributor "xtuc". Root question is that why was this PR merged? Apart from reading/writing to other files in the build pipeline instance (which is a really good catch), primary problem I see here is that anyone is able to deploy any arbitrary code/javascript to serve it from cdnjs. Just send a PR, then some contributor will merge it without checking the release package content. Don't you think that is open to a lot of issues?

Just to clarify, we won't just mirror any npm package. We have a set list of git repos and npm packages that we pull from, and adding a new one requires a PR to our packages repo which a human must review.

Okay, then how was OP able to push that symlink library. Dis he use an already approved library or submitted a new one.

Because if he did that symlink should at least raised some eyebrows at least

Ah. Nice.

Reply on news.ycombinator.com