NPM package compromised by author: erases files on RU / BY computers on install | Hacker News Reader

NPM package compromised by author: erases files on RU / BY computers on install

snyk.io

312 pointsasn007164 comments

Honestly a very harmful sort of "doing something about it". As if deleting someone's (presumably, normal people) files will make them more understanding of the difficulties in the ongoing conflict. Lying about it is also petty, as seen below. Malicious software is malicious regardless of any intentions and should be prosecuted as such. And if one really feels obliged to make their part as they wish, there's many examples of relatively harmless ways to do so, for example Notepad++ used to open a new tab with text inside, that is not particularly harmful.

>It is documented what it does and only writes a file if it does not exist. You are free to lock your dependency to a version that does not include this until something happens with the war, like it turns into WWIII and more of us wish that we had done something about it, or ends and this gets removed.

from https://github.com/RIAEvangelist/node-ipc/issues/233#issueco...

At this point any damage to the Russian economy translates to Ukranian lives saved.

Really? How do you save lives but deleting the average Dmitry's personal computer files? Maybe they were even working on a popular open source product as many average Russians tend to do.

You should re-evaluate your simplistic mindset

Causing tens or hundreds of thousands of wasted hours by (relatively) high-earning software developers in Russia (who average about 20k USD a year, or $11/hour) is only, generously, a few million dollars USD in "damages".

To clarify, not refuting your point. Just providing napkin math that I agree it doesn't do much.

Twitter has arrived.

Regardless of your political position, this falls well within the definition of malware. It's irresponsible for the maintainer to allow this: https://github.com/RIAEvangelist/node-ipc/issues/233

Yup. Although if you do want to get political, I'd say this falls under the definition of cyber warfare. Also the maintainer didn't only "allow" it, it seems he is the author of the malicious module as well.

Whats painful is that in terms of cyberwarfare, allied systems maintain dominance of global grid with innovation and open source. If we had allies in russia, im sure we have fewer now. This sort of DOS attack is effective in first order effects but the second order effects could be increased resentment and new systems developed in isolation.

Plenty of existing ransomwares delete user files on everything-but-RU machines. Perhaps the maintainer of this package subscribes to the old view that "turnabout is fair play".

"Some people in my country were victimized by organized crime in another country, so it's turnabout, and hence fair play, for me to victimize other people in that country"?

"Some people in my country were victimized by organized crime in another country, and that country's government didn't try to stop the criminal activity, so it's turnabout, and hence fair play, for me to victimize other people in that country"?

But that shouldn't be an excuse to sink to their level.

They haven’t really sunk to their level unless there’s an npm module to bomb hospitals I don’t know about. Still bad to target civilians, though.

Well I meant the level of ransomware authors and the like.

But whatabout the other guys????

Are you a child?

Good question, you should ask the maintainer that. I'm speculating about their possible motive for abusing the FLOSS ecosystem in such a destructive way, not trying to justify their behavior or anything.

> delete user files on everything-but-RU machines

Wasn't that about Cyrillic keyboard layout? Russia don't own neither Cyrillics, nor Russian language.

This still goes to the heart of the obligations of maintainers.

"THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE."

People keep placing obligations on maintainers in the FOSS ecosystem.

Maintainers don't have to do jank in this situation, except don't fraudulently distribute their software.

If they want to publish their upstream as malware, okay.

It's the end user's fault for continuing to pull that source code and integrate it into their system.

>If they want to publish their upstream as malware, okay.

I think you'll find that argument will not be very persuasive to a judge if the case is that the author of the software knowingly adds code in after people have integrated it into their systems that on purpose damages those systems.

Intention will often carry weight, and no claiming of rights and purity and see I wrote here you can't do anything to me! is going to persuade a judge that you can just go around destroying property because you want to.

If you sign a contract stating that you get 10k and in return I get to destroy your property. A judge is not very likely to enforce the payment but state that I should not destroy your property “because obviously thats not something you would like”

The license grants you usage but you agree to no responsibility for damages. You can’t cherry pick half of it, that defies the entire point of a license. The fact that you’d like to both Ear your cake and have it to does not have any weight in court.

Licenses aren't contracts, and more to the point, licenses grant you the right to copy or distribute the software, you do not need to agree to them for use (this is a very common misconception). You have the right to use the software if you have been given a copy by someone with the right to distribute the software, unless you have signed a contract with them stating otherwise (EULAs and other such attempts to force a one-sided contract onto users generally have little weight in court).

People are so clueless about law, this comment is a great example. A licence is worth jack shit in a criminal case (which this would be, if prosecuted).

Agree with this.

I think the difference is between sharing the code and pushing dodgy code down into npm. Which is my misunderstanding.

Pushing this dodgy code down to end users in Russia/Ukraine is a cyberattack.

Normally I agree, except in this case when the maintainer becomes the aggressor and literally installs malware to the user. This has nothing to do with FOSS and contributors being obligated to write better code, this is deliberately hacking someone.

That's like saying "it's your fault for giving them your password" when someone opens a phishing link. Yeah, all the scammers did was host a website and send emails, you chose to provide them your information. It doesn't make them not liable.

> If they want to publish their upstream as malware, okay.

NPM's terms explicitly disallow malware. They're free to put the raw source on say GitHub, but the author isn't permitted to package and distribute it on NPM.

https://docs.npmjs.com/policies/open-source-terms

You're spot on, my mistake.

I thought the author published it via Git and some npm maintainer scraped them.

If they distributed this code to end users that's just a cyberattack.

> This still goes to the heart of the obligations of maintainers.

I don't think this comes down to an "obligation" of open source maintainers. I think it's pretty evil of ANYONE to market software pretending it's one thing, when it reality it's malware. Open Source or not doesn't change that.

> It's the end user's fault for continuing to pull that source code and integrate it into their system. More than one party can be at fault.

So basically you're interpreting this clause as "if I want to be a total asshole, I can, and no one is allowed to complain"?

I reject that interpretation entirely. Sure, maybe the author isn't legally liable for any harm here (though I'm not entirely convinced that's the case), but we are all well within our rights to tell him he's an asshole for doing this.

Intent matters. The maintainer very clearly intended to do harm. They abused end user trust which is a common attack vector for many pieces of malware.

and sometimes people ask why I always vendor in in my go code deps and refuse to stop

Ok, sure. It's our fault.

But now that the maintainer became a malicious actor, I hope they are booted from the FOSS world and their github gets shutdown for illegal behaviour. This behaviour cannot go on unpunished.

I'm two days late but this is an argument for a developer not removing a security vulnerability from a dead project they've stopped maintaining, not this. I feel like not actively choosing to push malware to a repository where you know many, many automated systems will pull that malware onto the systems of your end-users due to a poor security model in the ecosystem you're developing in is a very very low bar of obligation as a maintainer.

Like, okay, you can't expect a doctor to save the life of every person who comes into the ER, but you can hopefully expect them not to start stabbing patients to death, and something should probably happen if they do, right?

Your argument makes sense for inaction (and is important and not brought up enough, honestly; there is a lot of entitlement in the open source world and people treat library developers in some pretty nasty ways), but not for action, as is the case here. The only obligation anyone expected here was the obligation to hold yourself back from making your project that gets millions of downloads per week point to malware.

I agree, I think I misread.

If you actively distribute, as in push your code out to the world via pushing it into npm, that's very different to sharing the code on GitHub.

I think a helpful guide is to ask myself: what would admired US and RU astronauts/cosmonauts do?

I imagine that they are scientists, engineers, and colleagues, and will treat each other with support, as people of goodwill.

There are other people who are active combatants right now, whether or not they want to be, and it is tragic beyond words.

I believe that one of the ways that we non-combatants can help is to set an example -- or to leave a door open -- to how we can treat each other when the current conflict is ended.

That doesn't include lashing out angrily and hurting our fellow open source community members, most of whom presumably want no part of the tragedy, and instead want the same things we do (e.g., to develop good software, collaborate and share with others, pursue careers and businesses, support families, etc.).

This is the sad thing about all of this. Many people are demonizing average Russian citizens for the actions of their government.

When the US invaded Iraq in 2003, I was very much against it, but felt powerless to change the course of my government. (And the US government kept on doing what it felt like, no matter how unjust its actions.) While I was ashamed of my country's actions, I didn't think it would be fair for people in other countries to punish me personally for them.

And this is in the US, a supposed liberal democracy! What chance does your average Russian citizen have of getting a dictator like Putin to change his mind here?

I agree with the sentiment here.

Theoretically though in representative democracy you choose the government to represent you and be an agent for making your decisions. You are responsible for what your government does in part that equals 1/Population

everybody knows that representative democracy is not representative. so, no, even theoretically you're not responsible for that reason. although you may be responsible for not doing anything to put in place a more representative democracy in your country (ie. be more involved in politics)

The average russian citizen supports the war

Maybe, but you can't prove that with polls. It's illegal to oppose the war in Russia. The polls everyone is citing were conducted by state TV.

Presuming they didn't just make up their data, imagine you got a call from state TV asking "if you support the special military operation to denazify Ukraine". Your friend just told you they know someone who knows someone who was arrested and charged with oppositing the war for holding up a blank piece of paper in public. Do you tell them the truth?

Edit: Here's an anecdote from Russian social media. A person asks why prices are so unstable. The entire shop looks at the ground, mumbles, and ignores them. Does that sound like enthusiastic support or terror to you? https://therussianreader.com/2022/03/16/dixie/

It's quite ironic how medias use Russian polls when it sticks to their narrative, and bashes them when it doesn't (i.e. Crimean referendum). We should take them all with the same level of skepticism.

It's a broader pattern where they pattern match words without understanding. Like assuming Patriarch Kirill is some kind of fatherly pope-like figure just because of the title and distinguished beard, when in reality he's an ex-kgb agent who made his fortune as a cigarette smuggling gangster.

I don't think it's about "the narrative" though. I've generally seen these polls used by people who self-identity as against the narrative. These polls are usually posted in the comments section to rebut articles arguing (correctly) not all Russians support the war.

If you look at the details it's also more optimistic than you might think. For example 25% of under-30s support the war.

https://meduza.io/en/feature/2022/03/07/russia-s-tricky-opin...

Majority of average Russian citizens support their goverment actions against Ukraine. So in my book, they are also responsible.

> Majority of average Russian citizens support their goverment actions against Ukraine

They do. Now, will installing malware on their computers make them change their mind and support Ukraine instead?

I don't advocate or support such malware instalation. Just saying that "Russian citizens have nothing to do with this war" is false. There are better ways to express your support for Ukraine, for example, make malware targeting only military or govermental institutions that are directly involved.

It may be the case but no one knows for sure. There is no independent sociology in Russia and the state controlled one is a gear in propaganda machine. Also many Russians are afraid to speak what they think and when asked just repeat what they heard on TV even if they don't agree.

This sort of logic justifies terrorist's killing of civilians like 9/11. If they can quote your book, the US citizens voted the governments in that oppressed and bombed members of their religion.

kbart doesn't defend the malware creator. He only made a counterargument to the statement that Russians aren't responsible for their government.

yes, but the majority of russian citizens don't install node modules. This is hitting a demographics where you have the least possible support for war and regime (which is also not small, but maybe, hopefully, not a majority)

> Majority of average Russian citizens support their goverment[sic] actions

That is a pretty bold claim to be made without any supporting evidence.

Majority of average American citizens support their government's actions against Iraq/Syria/Libya/Vietnam/... . So in my book, they are also responsible.

There is a proposal to add OCaps on a language level in TC39[0]. There is a drop-in implementation which already works in both Nodejs and browsers[1].

As a developer who wants to sandbox your own (recursive) dependencies, this is wrapped and made accessible today in Lavamoat[2]. Basically a package or app can provide a policy manifest specifying which capabilities (e.g. network or filesystem access) should be granted for each sandboxed dependency. Also comes with a tool that will auto-generate a starting point from your existing dependency tree.

IMO this is the future. Currently Lavamoat does come with a performance penalty but hopefully this idea will catch on and make it into language runtime implementations.

Lavamoat is still marked as "preprod" on npm but talking to the original author, the API is practically stable and it will shortly have its first stable release.

[0]: https://github.com/tc39/proposal-ses

[1]: https://github.com/endojs/endo/tree/master/packages/ses

[2]: https://github.com/LavaMoat/LavaMoat

People focus on the attack itself and reasons behind it. I feel that we are missing the bigger picture here: these type of supply chain attack in the open source world is a systematic problem. It’s a direct result of assumptions baked into services such as npm, pypi, rubygems, etc and assumptions people have regarding 3rd party dependencies.

The blast radius is monstrously giant. We seem to be still very naive in the way we approach, use, and implement those type of system, with an assumption that maintainers are working in good-faith and reliable.

I don’t know how things should be, and I don’t like to think of contributors and maintainers as a threat, but we have enough examples now to know ignore that risk is a fundamental issue.

I agree here, it's insane the number of dependencies JS developers are willing to take on. A decent sized project will see tens of thousands of extra files added to it (even if a lot of it is noncode stuff like licensing). From an outsider it even looks like employability of someone goes up if they manage to add extra dependencies to a project, since they can point to their download count to a prospective employer.

It's insane how much legal liability a company is at for agreeing to so many unread licenses. And how much attack surface they're exposing themselves to with their sprawling dependency chains.

This is a direct violation of the trust developers place in open source and does nothing to advance any individual's politics. This is purely malicious.

Beyond the obvious security considerations, there are also massive legal/IP considerations.

peacenotwar is explicitly GPLv3 but was added to node-ipc which still claims to be MIT licensed. Suddenly, any user shipping code dependent on node-ipc or Vue could be in violation of that license.

IANAL and don’t know if unknowing breach of the GPL would be enforceable… but zooming out, it’s worth noting that deep software supply chains can carry risk beyond just the risk of an explicit coded attack.

This is crazy. Are you hating on every Russian now ? Nobody is chocked by how anger against the the russian state shifted to hate against russian people ?

On top of that, petty, personal attacks like that have the absolute opposite effect if the supposed intention is to motivate russians to protest. It just makes people angry and suspicious of the west, nothing else.

It's been eye opening to see how easily we can normalize this type of stuff. Social media is also full of deranged calls for full on war against Russia (!!), war crime apologia, and just a pervasive hysterical discourse. The slope is getting so slippery that honestly it's got to stop. Let statesmen impose the sanctions that they deem necessary, they know better than random people.

What ukraine needs is advanced weaponry, financial and political support. Not this batshit insane vigilantism that will not end well and do absolutely nothing to hurt the Russian state. I cant even imagine if this happened to a more visible minority, say if China invaded taiwan? It's just scary.

I'm not saying this is on the same level at all, but I'm starting to understand how it got to the point where the internement of Japanese Americans was supported by a majority of Americans back in ww2. As a minority it just gives me this weird unsettling feeling that is a bit hard to explain, even if I'm not russian.

It’s straight out of 1984 groupthink. We have always been at war with Eurasia, they are the enemy.

We have always been allied with Mideastasia, let the oil plusflow like water!

https://www.youtube.com/watch?v=6-LRS9A-rW4

I have seen enough war crime photage that I am willing to accept any amount of civilian damage against Russia that is going to have an effect on the war, short of nukes.

When your government uses hospital locations as a target list and drop bombs on shelters, I don’t care if your files gets deleted.

> I have seen enough war crime photage

You have participated in too many instances of two minutes hate and were gaslighted by propaganda.

I laugh hysterically (in a very sad way), as I scroll through /r/Ukraine and see yet another video headlined as "Another Russian war-crime in Ukraine", that I had already seen few years ago headlined as "Ukrainian war-crime in Donetsk".

There is no truth anymore, literally every man for himself.

To me this is a call to get off the corporate controlled internet. People have been warning about this since like 2010, and I always agreed that there could be a danger, but I never realized just how bad it already is.

This is a kind of phenomena that I can only describe as internet psychosis. Considering how toxic all these platforms are, it's quite plain to see now that the people captured by them are not invested in reality and seem to be coalescing into a kind of psychotic frame of mind. Even people who aren't captured are affected by it, and I have no doubt that I've been subjected to multiple psyop and propaganda campaigns just by perusing sites like Twitter, Reddit and Youtube.

The modern internet is a warzone that weaponizes emotions. IMO, for the good of society and the future of the internet people need to get out as soon as possible and build new services that don't play into this.

Why is anyone surprised that this is happening. All you had to do is look at how people treat Asian people to realize what was going to happen to Russian people.

This seems like a rather silly form of protest. Delete people's files and the only thing you're creating here is more hatred directed at yourself.

If you want to sabotage all Russians for some weird reason, just introduce a race condition that's masqueraded as a compatibility fix for the Russian locale.

If you want to send out a message, take a more peaceful approach. Create file or print out a translated message like "<Citizen name>, age <age>, was killed in the illegal Russian invasion of Ukraine on <date>" in Russian. Add a link to a picture or a news article if you want. Still a pretty annoying move, probably universally considered in bad taste by most people, but not illegal or destructive. Add something like "the economic recession is because the Western world opposes the Russian government" to make that clear as well, because the immense inflation will probably hit random citizens hardest. Best case scenario you're informing some ignorant Russians stuck behind state propaganda, worst case scenario you piss off some Russian nationalists who will stop using your library.

In the end, this is just another demonstration of how dangerous modern dependency management is. NPM has been through leftpad, colors, now node-ipc, and there's still no way to prevent it from happening again.

I don't know of any language ecosystem with a package manager that doesn't have this problem as well. Perhaps the more boring/slow software dev requiring OS package managers, because Debian maintainers tend to be a little more level-headed than random Github users? Take your pips, cargos, gems, gradles, composers, and you'll find exactly this vulnerability.

The general consensus seems to be "it's impractical to validate all the code we're pulling in, so there's nothing we can do", which is kind of crazy in my opinion. Yes, modern dev does pull in a billion dependencies for every framework, but doing nothing just isn't a problem.

We're one NPM hack away from global catastrophe as long as we don't find a solution for problems like these.

I only read it briefly but the HN submission title talks about erasing files on RU/BY computers, while the blog post talks about creating files on desktop.

Could someone verify which statement is true?

> On March 8, at 7:25PM GMT+2 and less than four hours after node-ipc@10.1.3 had been published to roll back the destructive payload, a new major version node-ipc@11.0.0 was released on the npmjs registry.

The old version erased files, the new one leaves a file on the desktop.

Look like they realized the ramification and suddenly changed their payload. Well, that won't help them since companies who uses this module will have their legal department barking. They cannot erase the damage they have done and try to get away of the ramification with version. Since this is distributed through GitHub, Microsoft legal possibly will be involved due to possible violation of cyber/hacking laws in various countries. This is going to be ugly for the developers.

I don't see any issue for the developers at all. It is their software to create and alter as they see fit. End users choose to use the package, it is not being installed on their machines without their knowledge.

Four things:

1) Why they changed the code all of the sudden? If they are fine with realeasing this kind of damaging payoad, then why they decided to change the code? I mean they want to make a statement, right? Then they should leave the original code and stand by it. Why they are not standing by their statement?

2) Why RIAEvangelist editing people comments to minimize their languages? why they are censoring their comments? I checked the edited button and you can see RIAEvangelist made some interesting changes on their comments.

3) If RIAEvangelist felt his protest should be public and known, but users can't? You can clearly see they are trying to censoring comments and users at the beginning. So odd for developer who want to protest but yet refused to allow users to voice their protest. Strange strange mentality.

4) That is their free speech but that is only free speech from the governments. I realize my comment indicate about legal ramification. It is not the governments that RIAEvangelist should worry about, it is the private companies they should worry about, espically the platform they are using are known to be extremely litigious. They have far more power and money to ensure their maximum punishment. Private companies will use the law and lead hard on the government to do something. Private companies have done it before and they will do it again.

I don't have a issue with their principle. It just it is not the right platform/soapbox to use because it can cause unexpected damage if the original code is left up. It could spill to over companies who would be unintentionally targeted by it. Software is never perfect and it can be ugly. The developer have the right mind to change the code to minimize the damage because it will be ugly for them if they leave it up.

I'm curious if you think the same applies to a developer that writes any kind of ransomware when an end user downloads and installs it knowingly. End user trust is a common attack vector for malware and the developer here took advantage of that just like any other malware developer.

Must GPL my ransomware. Thanks for the reminder!

The analysis here is actually really frustrating. The initial code snippet is only partially analyzed. It makes a HTTP request to a third party geoip service to detect location, then recursively overwrites files if the location is Russia or Belarus. I can't understand why the article doesn't talk about this, but the code is there (albeit obfuscated).

Guy has his real name on his github page. Googled him, he has a Wikipedia page, created by a Wikipedia user with the same username as his Github one. Well, I think that says all I need to know about his character.

This developer has every right to a nervous breakdown over the war in Ukraine.

The npm ecosystem distributing yet another malicious module is more serious though.

There's no reason to excuse criminals over lack of enforcement.

So he’s a criminal now? Under what law, of what nation? Russia?

Wikipedia TOS

Criminal because of violating Wikipedia TOS. Seems about right. /s

Most countries have cybercrime laws that have clauses for malicious code. Here in Australia for example:

Cybercrime offences are found in Commonwealth legislation within parts 10.7 and 10.8 of the Criminal Code Act 1995 and include:

-Computer intrusions

-Unauthorised modification of data, including destruction of data

-Unauthorised impairment of electronic communications, including denial of service attacks

-The creation and distribution of malicious software (for example, malware, viruses, ransomware)

-Dishonestly obtaining or dealing in personal financial information.

Is it unauthorised if a user chooses to add the package themselves? This is not being put into anyone's machine clandestinely. It is the software user's responsibility to ensure the software is doing what you expect.

Upto a court to decide. Turns out he's in California which has laws against writing and distributing malicious code.

He's looking at state level:

if charged as a misdemeanor, the crime is punishable by: imprisonment in county jail for up to one year, and/or a maximum fine of $5,000.6

If charged as a felony, the offense is punishable by: imprisonment for up to three years, and/or a maximum fine of $10,000.7

Federal charges I'm not sure about.

Whats up with the .6 and .7?

Probably section numbers that copied and pasted weirdly.

inflation

Laws are enforced by people. I doubt any prosecutors will care, and if there are, I doubt any jury will convict.

I rather doubt grandma pressing OK when asked to install the CoolWebSearch toolbar would hold up as a legal defense.

IANAL, but I suspect that it is considered unauthorized as there are many avenues in which a dependency will get updated without a user specifying this exact package and version. I think the key here is that there is clear malicious intent.

Pretty sure under any Western country's law?

I love the idea we will soon have western and eastern open source projects. Even if internet isn't bifurcated, both sides will be too paranoid to install software from the other side. All software projects will have to pedantically vet every line of a commit, photo ID every contributor, to avoid subtle bugs intentionally committed and sent to millions.

Why stop at countries? How hard would it be to use ML to detect if the user has the wrong politics? Why stop at just deleting files? How about downloading as much illegal content as possible, sending embarrassing emails, etc? There's so many possibilities here.

> photo ID every contributor

If the Western FOSS ecosystem demands KYC from me I'm dumping them for the Non-Aligned Movement.

- @vue/cli

   - @vue/cli-ui

      - node-ipc@^9.2.1

   - @vue/cli-shared-utils

      - node-ipc@^9.1.1

due to the nature of the ecosystem i feel like

- pinning the dependencies

- running something like renovate

- merging the resulting MR’s with quite a delay from when they were opened

as some basic steps in mitigating this sort of silly, but potentially expensive, stuff.

n-1 is a great concept that works right up until log4shell starts happening.

The solution is to audit all code you rely on, the unviability of that solution is the fault of the npm micro package ecosystem.

The micro package ecosystem is also self-reinforcing: some micro packages were created by the same developers who have spun ownership of these things into more lucrative positions.

I've tried to get rid of micro packages in the dependency tree of popular libraries, but because it's a turf war, PRs get closed, and the problem continues.

I don’t think anything will change until large development firms pressurise popular projects to stop the behaviour.

I hope you speak with executive and lead developers to highlight the volatility of the ecosystem, like I do, every chance I get.

Node.js just needs a proper standard library and this will stop in no time. Never going to happen though.

Curious why that might be, if you have any insights?

Note that the only vulnerable version was @vue/cli v5.0.2, which was intended to pin the version of node-ipc to v9.2.1 but accidentally allowed versions greater than that: https://github.com/vuejs/vue-cli/commit/37ef809c873f33c88ba7...

The mistake was fixed within 6 minutes: https://github.com/vuejs/vue-cli/commit/b0d931668e7e8450a285...

It looks like the malware version of @vue/cli has been downloaded a total of 170 times.[1] That's 0.13% of all downloads of that package this week. It's also important to note that @vue/cli has been deprecated for months. If you're making a new Vue project today[2] you'll use create-vue[3] which doesn't depend on node-ipc at all.

1. https://www.npmjs.com/package/@vue/cli?activeTab=versions

2. https://vuejs.org/guide/quick-start.html

3. https://github.com/vuejs/create-vue

Guess it's time to chroot each project folder if you're using any package manager or external libraries. Though on second thought it's just a band aid as the damage which can be done after deployment is far worse than anything before.

“Trust takes years to build, seconds to break, and forever to repair”.

In war, collateral damage, or the harming of non-combatants is usually justified by the argument that it deals significant enough damage to enemy combatants to outweigh the harm done to civilians.

What would you call an operation that has nearly 0 effect on enemy combatants and only deals damage to civilians?

Terrorism?

slacktivism

What's next? Prescribe wrong medications to Russians?

Comments seem split between "that's illegal, beware the lawyers" and "don't RCE yourself then cry about it".

I've got some bash scripts on GitHub that would delete files on the local machine if run. Today I don't care if anyone else runs them. If however the winds are blowing towards people doing themselves harm with my code is my problem, I guess I should delete the code I've published.

Bad precedent to see here.

Big difference between random code on GitHub and modifying a high-use JS dependency to delete user files. I'm not against protesting in software, for example printing something to stdout during install, but deleting files is malicious beyond reprieve.

Maybe, I'm not totally confident about there being a meaningful difference.

If the former counts as distributing malware, my bash script that clobbers local directories to put the machine back into a sane default state might be too. It does rm -rf ~/$DIR and similar. It's just not as successfully deployed.

Or software that wastes resources, maybe it goes into an infinite loop and DoS the local CPU. I've got one of those called 'heater' or similar that I used to warm up a macbook in a cold office. If someone ran that on cluster it would be unhelpful.

Maybe the change in functionality to malware from a widely shipped useful product is the key distinction, coupled with limited disclosure of the behaviour change.

Our phones have all kinds of spyware on it from the vendor, from Google and from 3rd party apps. They probably also have, as well as routers, tons of vulnerabilities know but not fixed due to the lack of interest from the vendors. Sometimes Google cancel accounts blocking access to all of it's data without giving reason or recourse.

It's 'funny' and hypocritical (as many folks here work for Google and other companies related to aforementioned issues) that we're condemning a dude for getting emotional and causing limited damage on cyberspace while a crazy dude is wrecking destruction on meatspace, killing thousands and threatening the World with nuclear war.

I understand the fears that this can undermine this nice thing we have that is opensource. Though the nice thing is that individuals voluntarily share code for whatever intrinsic reasons they have. MIT provides no warranty of any kind and there's no moral obligation to serve and make it corp-friendly. As developers our code is generally the only 'real' power we have and we can't deny that guy his agency.

RIAEvangelist was sloppy and probably will suffer consequences for his activism. Being banned from Github and NPM registry are expected and fair due to probable ToS violations and the interest of the organizations in preserving trust. But I fail to see how what he did is more or less ethical than financial sanctions like those recent applied to Russia. If he were to make it look like a mistake it would save him the trouble because ignorance/incompetence are socially accepted.

Never a better time to be vendoring your npm deps & reviewing the updates to packages. Not too difficult to pull in the new version, then git diff the changes in the `lib` directory of that package.

There is a possibilty that Russia reports that through Interpol Cybercrime or via diplomatic channel, then FBI will have to investigate and possibly lock up Brandon.

No, this mechanism is simply not working.

Western politicians and public media have been bashing and portraying Russia as "a haven for hackers" for some time now, but it's not like the US is any better from Russian perspective.

Russian law enforcement has huge stacks of unsolved cybercrime cases, that are essentially blocked by lack of cooperation from a foreign counterpart.

No reason for the West to cooperate when Russia doesn't either.

And no reason for Russia to cooperate when the West doesn't either.

Welcome to global politics, where the leaders of the world's superpowers can't do any better than kindergarten-level "no you!" argument.

"you get what you pay for"

Kind of a thoughtless comment from an industry that owes so much to the open source community.

But muh security patches!!!!!!

You know what this is? This is a Civil World War. And it is only just starting.

This is so CURRENTYEAR. We're reaching levels of slacktivism so fucking stupid I honestly don't know where we go from here. I thought changing "master" to "main" was fucking stupid, but this really takes the cake. I foresee a future where someone does this for all Texas IPs because they delusionally believe it's being ran by neo-Nazis, that Texas is a fascist state.

I don't know how I feel about this.

One hand, this is a seemingly non-violent and subtle way to protest. On the other, the potential collateral damage is huge and just burns all trust with this developer, and is a net harm to the ecosystem as a whole.

FOSS is great, because we were actually able to track the changes here. But it also points out how many packages go un-checked and just installed into a container running with root permissions.

it isn't going to stop Putin but it could negatively impact normal people. in no universe will the handful of Russian programmers impacted by this rise up and overthrow their government. but they will be forced to work extra hours cleaning up any damage this caused to their system. This is really lame virtue signalling that only harms fellow workers because their government is terrible.

But this is pretty much the exact logic sanctions work by. Putin and his cronies might lose some super yachts but the main aim is to crash the Russian economy, which will hurt everyday Russians far more than any leader. Not that I have any better ideas, but you could argue this move is in a similar vein.

The sanctions also choke the state's military of funding.

Sanctions lower taxes which hurt the government funding. It may or may not be effective but they are not remotely the same.

So sanctions? I get it, collateral damage is indeed collateral. That's why I don't know how to feel.

If this move broke some key software used on the battlefield, would we all be so quick with our positions?

> I don't know how I feel about this.

> One hand, this is a seemingly non-violent and subtle way to protest.

You can't be serious. Being non-violent and subtle is no excuse for deliberately making software have real side effects on a computer that it's not advertised to do, especially a node library. Node modules for some reason tend to be very small and have trivial tasks like checking if something is a number. Imagine if everything shipped with it's own political malware.

No matter how you want to spin it this is completely unacceptable and nobody should ever trust this developer again.

> But it also points out how many packages go un-checked and just installed into a container running with root permissions.

The fact that "packages go unchecked" doesn't make this okay either.

I dunno. If you’re sloppy enough to install whatever dependencies onto your system, and not notice a new dependency, called “peacenotwar”, I’d say it’s your problem.

Doesn’t necessarily make it OK, but this will only affect the sloppy.

No one is going to audit the entire transitive closure of their dependency graph for every project they try out on their computer. This is not just going to affect the sloppy.

>Imagine if everything shipped with it's own political malware.

Then people could write their own code to check if something is a number.

I didn't condone anything or anyone, I just stated I wasn't sure how to feel about it.

Anny assumptions or claims beyond that are your own delusions.

Its childish. Striking out maliciously at random web developers surrounded by state propaganda is counter-productive. This just annoys them and feeds the narrative that they're under attack by the West who hates them.

I would imagine web developers over there, being more educated, technical, and exposed to the West, would be the ones less likely to support the war.

There's nothing subtle about wiping files, why not provide news and information that's being blocked? This could have been an information bridge that would be hard to censor. Hell, run a crypto miner on their machine and donate to Ukraine if you're trying help, that'll have more of an impact then wiping some poor dev's files.

100%

> why not provide news and information that's being blocked?

Radio free europe style. I like it

> why not provide news and information that's being blocked

It's not really an issue to bypass blocks (how do you think Russians access rutracker). Especially not for a person who is capable of doing something with NPM packages.

Your suggestions are also childish and just as flippant.

I don't know how to feel about this because it's not much different than sanctions in theory (very different in execution). Cause pain for people so they "force internal change."

It's not something to root for gleefully.

It's his software, he can do what he wants with it. It is the responsibility of those who use packages to determine what it is doing. Everyone is free to write their own version or even fork an earlier version of the code if they want.

t. malware writer

Reply on news.ycombinator.com