3 ms·
I wouldn't use the words "malicious" or "exploit" wrt this... It's more like, I dunno, trolling on planet JavaScript? I feel like there should be a big Twitte
by a-dub 7y ago
I wouldn't use the words "malicious" or "exploit" wrt this... It's more like, I dunno, trolling on planet JavaScript? I feel like there should be a big Twitter fight about it...
- Thorrez 7y agoshinnn is claiming his account was hacked, and the hacker added the code. Generally if a hacker hacks someone's npm account and adds harmful code, that would be considered malicious and an exploit.
- Kiro 7y agoThat's obviously a lie though.
- Thorrez 7y agoYes, but it sounds like Harry Garrood doesn't have enough evidence to outright accuse shinnn of lying, and the NPM team also is acting as if shinnn isn't lying. So instead of going on a lone and not-fully-backed-up crusade accusing shinnn of lying that could wind up in a he-said-she-said situation with negative fallout, Harry instead decided to use shinnn's words for his own benefit, and hype it up as a serious NPM account hacker inserting malicious code.
- nameiscubanpete 7y agoThat was my first thought. But then I realized some guy basically broke something so his stuff would work and someone else's wouldn't. He didn't destroy files, but that was malicious as hell.
- a-dub 7y agomean spirited and dramatic as hell, yes... also, a bad place where real "malicious" things could be done. but "malicious" has a specific meaning and this didn't affect users. more like dramaticious if you ask me... but also uncovers actual dangerous weaknesses in the npm delivery pipeline...
- a-dub 7y agoit's kinda like a cat-fight in the one hundred acre javascript wood... pretty harmless, nobody's shit got pwned, but holy shit, kind of a vulnerable vector they found...