12 ms·

Tell HN: Node.js koa-router package transferred to unknown user

121 points by niftylettuce 8y ago

k__ 8y ago
Is NPM at it again?
- untog 8y ago
  I don't think NPM themselves have done much here. The original owner of the module sold(!) the package name and transferred it to a new owner. It's not like this was somehow sneakily stolen.
  - jhare 8y ago
    I agree on them not doing much. As in not much at all to help. How about I just go ask for every package on NPM and see who's busy enough to deal with that or not? I love Javascript but the ecosystem stinks.
    - yazboo 8y ago
      Could you not do that on PyPi and rubygems as well?
      - doublerebel 8y ago
        Absolutely not. PyPi and Rubygems have much more strict and sane ownership policies to prevent unauthorized takeovers of packages. (Same with apt and every other major package repo.) No package in any package manager, if it contains code, and greater than 0 downloads and dependencies, should ever be replaced. The cost of storing an old package is miniscule compared to a system where anyone can petition for a package name takeover and cause unlimited cost through the effects of takeover. 30 days is absurdly short in the lifetime of software and does nothing good for the community. Package squatting is not a real problem for anyone. In this case, the owner wanted the ownership change so it's really a non-event.
        krainboltgreene 8y ago
        > Rubygems have much more strict and sane ownership policies to prevent unauthorized takeovers of packages No we don't. Our process is just as secure as npm's. Please stop talking about things you don't actually know.
    - krapp 8y ago
      Yeah, it's unfortunate that the entire Javascript ecosystem is inextricably wedded to a single company's registry and package manager but what can you do? We all just have to put up with it, I guess.
binarymax 8y ago
The npm package ownership process is flawed. Anecdotally, I received an email from npm support saying someone requested publish rights to a package that I manage. The default was that the access would be granted if I did not respond within 30 days. It's very possible this went through npm support, they received no reply within the window, and the transfer was granted. There are good practices around domain names to lock transfer, perhaps npm should consider adopting similar mechanisms. --edit-- for the curious, here is the redacted email chain. I don't want to call anyone out on this. These things are hard and handling edge cases are very difficult. I love npm, and host several packages there. I really appreciate everything they've done for node and javascript, and I think folks are harder on them than they should be due to some tricky decisions they've made. But I want things to improve for everyone, so consider this a disclosure for analysis on how things can get better. https://pastebin.com/636v8YSP https://pastebin.com/636v8YSP
- deleted 8y ago
  [deleted]
- basil-rash 8y ago
  What a strange exchange. Why would npm assume that you actually want to add this random third party as a user? Could the package in question have appeared "dead" (i.e. no recent updates, not many weekly downloads)?
  - binarymax 8y ago
    It wasn't dead, but I hadn't updated it in awhile and it wasn't the most popular thing in the world.
- pscanf 8y ago
  I've been on the other side of a similar conversation, that eventually got me the name I wanted after around 30 days. This was around five years ago, when there were still no scoped packages and the ecosystem was surging in popularity. I guess in the previous years people had been creating test packages and forgetting about them, and no doubt some were just squatting popular names. In my case the package with the name I wanted was empty and inactive, and there was a human check before it being handed over.
gammateam 8y ago
thats actually a kind of cool attack vector.
niftylettuce 8y ago
To anyone reading this, I'm building a tool to automate this nonsense, at least until Node/NPM do something about it. Email me at niftylettuce@gmail.com if you want to get notified once it's up. It will be free and open-source.
- fireattack 8y ago
  >automate this nonsense What exactly are you automating? A notification system for transferring of ownership?
  - niftylettuce 8y ago
    Everything related to this nonsense
ldiracdelta 8y ago
Maybe transfer of ownership should be a mandatory major version bump with no option to release to lower major versions anymore.
- pscanf 8y ago
  Transfer of ownership can be done "unofficially" in many ways though, for instance adding a contributor to the organization which controls the package. Requiring a major bump could be problematic in many cases (I'm thinking, @microsoft adding a member to their team would require a major for all their packages). And one can always sell their entire npm account, and no-one would notice.
javitury 8y ago
koa-router was owned by @alexmingoia and not by @koajs. Still it is a central piece of the koa framework that compromises practically every koa setup. The only alternative I have found is this: https://github.com/koajs/trie-router https://github.com/koajs/trie-router The transition from express to koa has been slow, and this doesn't help. It will undermine the confidence on the koa framework.
- bearmcbearsly 8y ago
  Now that you can trivially use async functions as express handlers, what are the major benefits of transitioning to Koa?
  - Sytten 8y ago
    None to be honest. I migrated my projects back to express. Most of the packages for koa are either unmaintained or not very active.
  - move_zig 8y ago
    I regularly use async functions as handlers in Express, but I always include a try ... catch block inside each one. What's the trivial way to use them?
  - midway 8y ago
    Turn-key ready http2 which is significantly faster.
lioeters 8y ago
Although nothing malicious has happened yet, that change in the readme ("this package name is for sale") is spammy and concerning. Kudos on niftylettuce (love your blog!) for raising awareness. This is yet another example of a (by now fairly known) vulnerability in the npm package ownership transfer process. Just a few months ago, there was a big drama with malicious code found in a popular package `event-stream`, placed by a new unknown owner. I like one of the ideas in the GitHub issue, that a change in package ownership should be considered a major semver bump. At least that might reduce the reach of a bad actor who would buy a popular package for exploitation.
- _bxg1 8y ago
  Woof. I didn't even notice the "for sale" part at first. That's probably the biggest red flag. You should never sell a backdoor into thousands of codebases to the highest bidder. Of course, the real problem is thousands of codebases shouldn't be banking on the honor system for stuff like this.
amingoia 8y ago
Please stop harassing me. Let's set the record straight. The Koa organization did not write, maintain, or ever help with this package. I wrote it. I maintained it, with help from people who reached out to me directly (and actually contributed code). @ZijianHe offered to maintain it, and I agreed to let him maintain it. Our relationship is not anyone's business. I don't have a relationship to the koa organization. I don't know them. Furthermore, @niftylettuce has repeatedly in emails to npm asserted that ZijianHe is Chinese, despite this having nothing to do with anything, or even knowing whether ZijianHe lives in China. Chinese developers have contributed more to this repository than anyone from the Koa organization. This kind of racial scaremongering or guilt by association is not acceptable. Its offensive. Let's be very clear: Developers from any ethnicity and nationality are welcome to contribute to open source. I'm not going to say anything more on this issue. This is beyond ridiculous.
- niftylettuce 8y ago
  To clarify things for the community: 1) No, they (Chinese developers) have not contributed more. You revoked access from @jbielick who was #2 contributor to the package behind you. He messaged me in Slack today that he received zero notification from you and simply received a notification from NPM that he was removed access from the package. You removed his access completely from NPM. 2) My email to you prefaced the concern of the China-based user with "completely unknown" and "To an outsider". Here's the original email to clarify it for people viewing this from an incorrect context: Hi Alex, Thanks for your work in the open source community. I am curious, since the project is open source, if you will be transparent as to the transfer of the koa-router repository and NPM ownership to a completely unknown user "ZijianHe" to the community. Was there a monetary transaction? Why did you choose him? Why not transfer to the KOA org? To an outsider, this is all a huge red flag, as an unknown Chinese GitHub user suddenly has full control of a NPM package with 130K weekly downloads and is used by major corporations. 3) I did not "repeatedly" assert that. I stated the word "Chinese" one time. One time is not "repeatedly". I would share with the community your response to my message, but I am not going to do so.
  - pryce 8y ago
jeremejevs 8y ago
Tangential, but koa-router isn't even that great, been using koa-tree-router [0] instead. Fewer dependencies, no API oddities and long-standing bugs [1], faster. It's much younger (less battle-testing), and has no regex and multi-parameter routes, but is worth considering. [0] https://github.com/steambap/koa-tree-router https://github.com/steambap/koa-tree-router [1] https://github.com/ZijianHe/koa-router/issues?q=is%3Aissue+is%3Aopen+sort%3Acomments-desc https://github.com/ZijianHe/koa-router/issues?q=is%3Aissue+i...
deleted 8y ago
[deleted]
ZijianHe 8y ago
Hi all. I am the one who took over the repo. Thanks for some of you guys reaching out. I haven't been contributing to open source projects before so I don't have too much public information on my Github account. Thus I think it would be a good opportunity for me to join the open source community by maintaining the koa-router project. I will start reviewing PRs and getting rid of issues after I finish going thru the code. Any suggestions are welcome
midway 8y ago
Not commenting about the transfer but the urge from some to move this to the koajs organization (which is silly request): Great about koa is that it's not a monoculture like express. express has all batteries included and lacks a healthy ecosystem. Yes, there is a lot stuff out but everything in and around express feels broken. Yes, you can use it and it's ok but you not really happy. This paired with the same maintainers who also are on connect, express-generator, etc. They do all together a great job maintaining express but you feel the lacking pace in all these project. express still lacks hhtp2 (not turn-key-ready), express-generator is full of strange edge-cases nobody needs (in the www file) polluting your code. express docs got better but still. But we as a community need healthy competition and if koa-router moved to koajs you'd start the next monoculture and new contenders wouldn't have any chance to establish because there is a default router. The key to be successful is to build a minimal/barebone product and let others create additions and not swallowing everything into a slow org. And tbh, I like koa-router but simple stuff like a regex path matching is not included where I need my own middleware (I mean it's a few lines but still). Everyone who don't like this move, fine, fork koa-router and make it better and we will see if koa-router's new maintainer is a real maintainer who will push the product. Or just write your own router, it's not that hard. Forking and improving is open source not complaining in dozen threads and pressuring people to hand out a repo (this reminds me of office politics and blackmailing" 'give us the repo or we destroy your and the new maintainer's reputation online'). I think it's more about getting the SEO-relevant Github and npm name 'koa-router'. So guys, just stop it, welcome the new guy and/or fork, I am happy to yarn add your fork.
AtroxDev 8y ago
The new owner just confirmed that he purchased the package: https://github.com/ZijianHe/koa-router/issues/494#issuecomment-463474660 https://github.com/ZijianHe/koa-router/issues/494#issuecomme... (in case the comment gets deleted: https://i.imgur.com/J5lOiMZ.png https://i.imgur.com/J5lOiMZ.png)

121 points by niftylettuce 8y ago

k__ 8y ago

Is NPM at it again?

untog 8y ago
I don't think NPM themselves have done much here. The original owner of the module sold(!) the package name and transferred it to a new owner. It's not like this was somehow sneakily stolen.
- jhare 8y ago
  I agree on them not doing much. As in not much at all to help. How about I just go ask for every package on NPM and see who's busy enough to deal with that or not? I love Javascript but the ecosystem stinks.
  - yazboo 8y ago
    Could you not do that on PyPi and rubygems as well?
    - doublerebel 8y ago
      Absolutely not. PyPi and Rubygems have much more strict and sane ownership policies to prevent unauthorized takeovers of packages. (Same with apt and every other major package repo.) No package in any package manager, if it contains code, and greater than 0 downloads and dependencies, should ever be replaced. The cost of storing an old package is miniscule compared to a system where anyone can petition for a package name takeover and cause unlimited cost through the effects of takeover. 30 days is absurdly short in the lifetime of software and does nothing good for the community. Package squatting is not a real problem for anyone. In this case, the owner wanted the ownership change so it's really a non-event.
      - krainboltgreene 8y ago
        > Rubygems have much more strict and sane ownership policies to prevent unauthorized takeovers of packages No we don't. Our process is just as secure as npm's. Please stop talking about things you don't actually know.
  - krapp 8y ago
    Yeah, it's unfortunate that the entire Javascript ecosystem is inextricably wedded to a single company's registry and package manager but what can you do? We all just have to put up with it, I guess.

binarymax 8y ago

The npm package ownership process is flawed. Anecdotally, I received an email from npm support saying someone requested publish rights to a package that I manage. The default was that the access would be granted if I did not respond within 30 days. It's very possible this went through npm support, they received no reply within the window, and the transfer was granted. There are good practices around domain names to lock transfer, perhaps npm should consider adopting similar mechanisms. --edit-- for the curious, here is the redacted email chain. I don't want to call anyone out on this. These things are hard and handling edge cases are very difficult. I love npm, and host several packages there. I really appreciate everything they've done for node and javascript, and I think folks are harder on them than they should be due to some tricky decisions they've made. But I want things to improve for everyone, so consider this a disclosure for analysis on how things can get better. https://pastebin.com/636v8YSP https://pastebin.com/636v8YSP

deleted 8y ago
[deleted]
basil-rash 8y ago
What a strange exchange. Why would npm assume that you actually want to add this random third party as a user? Could the package in question have appeared "dead" (i.e. no recent updates, not many weekly downloads)?
- binarymax 8y ago
  It wasn't dead, but I hadn't updated it in awhile and it wasn't the most popular thing in the world.
pscanf 8y ago
I've been on the other side of a similar conversation, that eventually got me the name I wanted after around 30 days. This was around five years ago, when there were still no scoped packages and the ecosystem was surging in popularity. I guess in the previous years people had been creating test packages and forgetting about them, and no doubt some were just squatting popular names. In my case the package with the name I wanted was empty and inactive, and there was a human check before it being handed over.

gammateam 8y ago

thats actually a kind of cool attack vector.

niftylettuce 8y ago

To anyone reading this, I'm building a tool to automate this nonsense, at least until Node/NPM do something about it. Email me at niftylettuce@gmail.com if you want to get notified once it's up. It will be free and open-source.

fireattack 8y ago
>automate this nonsense What exactly are you automating? A notification system for transferring of ownership?
- niftylettuce 8y ago
  Everything related to this nonsense

ldiracdelta 8y ago

Maybe transfer of ownership should be a mandatory major version bump with no option to release to lower major versions anymore.

pscanf 8y ago
Transfer of ownership can be done "unofficially" in many ways though, for instance adding a contributor to the organization which controls the package. Requiring a major bump could be problematic in many cases (I'm thinking, @microsoft adding a member to their team would require a major for all their packages). And one can always sell their entire npm account, and no-one would notice.

javitury 8y ago

koa-router was owned by @alexmingoia and not by @koajs. Still it is a central piece of the koa framework that compromises practically every koa setup. The only alternative I have found is this: https://github.com/koajs/trie-router https://github.com/koajs/trie-router The transition from express to koa has been slow, and this doesn't help. It will undermine the confidence on the koa framework.

bearmcbearsly 8y ago
Now that you can trivially use async functions as express handlers, what are the major benefits of transitioning to Koa?
- Sytten 8y ago
  None to be honest. I migrated my projects back to express. Most of the packages for koa are either unmaintained or not very active.
- move_zig 8y ago
  I regularly use async functions as handlers in Express, but I always include a try ... catch block inside each one. What's the trivial way to use them?
- midway 8y ago
  Turn-key ready http2 which is significantly faster.

lioeters 8y ago

Although nothing malicious has happened yet, that change in the readme ("this package name is for sale") is spammy and concerning. Kudos on niftylettuce (love your blog!) for raising awareness. This is yet another example of a (by now fairly known) vulnerability in the npm package ownership transfer process. Just a few months ago, there was a big drama with malicious code found in a popular package `event-stream`, placed by a new unknown owner. I like one of the ideas in the GitHub issue, that a change in package ownership should be considered a major semver bump. At least that might reduce the reach of a bad actor who would buy a popular package for exploitation.

_bxg1 8y ago
Woof. I didn't even notice the "for sale" part at first. That's probably the biggest red flag. You should never sell a backdoor into thousands of codebases to the highest bidder. Of course, the real problem is thousands of codebases shouldn't be banking on the honor system for stuff like this.

amingoia 8y ago

Please stop harassing me. Let's set the record straight. The Koa organization did not write, maintain, or ever help with this package. I wrote it. I maintained it, with help from people who reached out to me directly (and actually contributed code). @ZijianHe offered to maintain it, and I agreed to let him maintain it. Our relationship is not anyone's business. I don't have a relationship to the koa organization. I don't know them. Furthermore, @niftylettuce has repeatedly in emails to npm asserted that ZijianHe is Chinese, despite this having nothing to do with anything, or even knowing whether ZijianHe lives in China. Chinese developers have contributed more to this repository than anyone from the Koa organization. This kind of racial scaremongering or guilt by association is not acceptable. Its offensive. Let's be very clear: Developers from any ethnicity and nationality are welcome to contribute to open source. I'm not going to say anything more on this issue. This is beyond ridiculous.

niftylettuce 8y ago
To clarify things for the community: 1) No, they (Chinese developers) have not contributed more. You revoked access from @jbielick who was #2 contributor to the package behind you. He messaged me in Slack today that he received zero notification from you and simply received a notification from NPM that he was removed access from the package. You removed his access completely from NPM. 2) My email to you prefaced the concern of the China-based user with "completely unknown" and "To an outsider". Here's the original email to clarify it for people viewing this from an incorrect context: Hi Alex, Thanks for your work in the open source community. I am curious, since the project is open source, if you will be transparent as to the transfer of the koa-router repository and NPM ownership to a completely unknown user "ZijianHe" to the community. Was there a monetary transaction? Why did you choose him? Why not transfer to the KOA org? To an outsider, this is all a huge red flag, as an unknown Chinese GitHub user suddenly has full control of a NPM package with 130K weekly downloads and is used by major corporations. 3) I did not "repeatedly" assert that. I stated the word "Chinese" one time. One time is not "repeatedly". I would share with the community your response to my message, but I am not going to do so.
- pryce 8y ago

jeremejevs 8y ago

Tangential, but koa-router isn't even that great, been using koa-tree-router [0] instead. Fewer dependencies, no API oddities and long-standing bugs [1], faster. It's much younger (less battle-testing), and has no regex and multi-parameter routes, but is worth considering. [0] https://github.com/steambap/koa-tree-router https://github.com/steambap/koa-tree-router [1] https://github.com/ZijianHe/koa-router/issues?q=is%3Aissue+is%3Aopen+sort%3Acomments-desc https://github.com/ZijianHe/koa-router/issues?q=is%3Aissue+i...

deleted 8y ago

[deleted]

ZijianHe 8y ago

Hi all. I am the one who took over the repo. Thanks for some of you guys reaching out. I haven't been contributing to open source projects before so I don't have too much public information on my Github account. Thus I think it would be a good opportunity for me to join the open source community by maintaining the koa-router project. I will start reviewing PRs and getting rid of issues after I finish going thru the code. Any suggestions are welcome

midway 8y ago

Not commenting about the transfer but the urge from some to move this to the koajs organization (which is silly request): Great about koa is that it's not a monoculture like express. express has all batteries included and lacks a healthy ecosystem. Yes, there is a lot stuff out but everything in and around express feels broken. Yes, you can use it and it's ok but you not really happy. This paired with the same maintainers who also are on connect, express-generator, etc. They do all together a great job maintaining express but you feel the lacking pace in all these project. express still lacks hhtp2 (not turn-key-ready), express-generator is full of strange edge-cases nobody needs (in the www file) polluting your code. express docs got better but still. But we as a community need healthy competition and if koa-router moved to koajs you'd start the next monoculture and new contenders wouldn't have any chance to establish because there is a default router. The key to be successful is to build a minimal/barebone product and let others create additions and not swallowing everything into a slow org. And tbh, I like koa-router but simple stuff like a regex path matching is not included where I need my own middleware (I mean it's a few lines but still). Everyone who don't like this move, fine, fork koa-router and make it better and we will see if koa-router's new maintainer is a real maintainer who will push the product. Or just write your own router, it's not that hard. Forking and improving is open source not complaining in dozen threads and pressuring people to hand out a repo (this reminds me of office politics and blackmailing" 'give us the repo or we destroy your and the new maintainer's reputation online'). I think it's more about getting the SEO-relevant Github and npm name 'koa-router'. So guys, just stop it, welcome the new guy and/or fork, I am happy to yarn add your fork.

AtroxDev 8y ago

The new owner just confirmed that he purchased the package: https://github.com/ZijianHe/koa-router/issues/494#issuecomment-463474660 https://github.com/ZijianHe/koa-router/issues/494#issuecomme... (in case the comment gets deleted: https://i.imgur.com/J5lOiMZ.png https://i.imgur.com/J5lOiMZ.png)