3 ms·
> maintains hundreds of packages Might be worth looking over some of these to see if he has also given access of them to some dodgy people. As most of them app
by chippy 8y ago
> maintains hundreds of packages
Might be worth looking over some of these to see if he has also given access of them to some dodgy people. As most of them appear to be as old as event-stream and are also probably as unused by him. And if we are concerned, we should, he would advise, simply make a fork and write an email to npm to warn them. But hes a good guy, so don't blame him if you find that he's done this before in the other 422 packages.
Edits: I mean I do understand having software that's old and unmaintained, and it's fine and easy to hand off control to others - we developers are generally trusting of other developers. I wonder if he has also trusted others in this way before and that he has been exploited before without anyone knowing.
- gregknicholson 8y ago> And if we are concerned, we should, he would advise, simply make a fork and write an email to npm to warn them. Well... yeah. If you don't trust him, don't trust him. If you don't trust NPM's vetting, don't trust NPM's vetting.
- mattdeboard 8y agonpm does vetting?
- cmorgan31 8y agoNPM increased their efforts with regards to auditing. They realized it was a prominent attack vector and without them taking responsibility for some level of the problem they would be throwing their reputation down the drain. It isn't perfect, but it's a step to improving the situation.
- mattdeboard 8y agoSweet! There are so many brilliant & creative people in the Node community. I'm positive there are some innovative ways to approach this problem.