3 ms·

> Packages are literally remote code exec vulns in the hands of package authors Something mentioned in this article caught my eye: > While searching for Marak

> Packages are literally remote code exec vulns in the hands of package authors Something mentioned in this article caught my eye: > While searching for Marak’s libraries, I found this npm-test-access library. This library seems to be used for what the name describes: to test access to NPM. Marak seems like a very capable software engineer, and it’s unclear to me why he’d need a package like this. So, this make me personally doubt a little bit if Marak is really behind all of this, or if maybe his account got compromised, or if something else it at play. — [0] https://jworks.io/the-faker-js-saga-continues/ https://jworks.io/the-faker-js-saga-continues/ If you wanted to take over other people’s NPM packages by pushing a compromised update to one of your own widely used packages, the first thing it would do is check to see if the victim had access to publish to NPM. Marek, who has just started publishing malicious updates to his own widely used packages, has just created a package to check for access to NPM.

zaroth 5y ago
This seems like irresponsible speculation and insinuating that Marek is about to commit a felony? I’d rather skip the character assassination based on hypothetical future actions please, and focus on what’s actually happened.
- JimDabell 5y ago
  > Packages are literally remote code exec vulns in the hands of package authors There are 20m+ weekly downloads of the colors package alone. He has what amounts to remote execution privileges to people using that package. When the subject of compromised packages comes up and he’s demonstrated that he’s willing to publish malicious updates, it’s completely fair to wonder what else he’s willing to do with that level of access to that many systems. It’s irresponsible not to consider what his packages can do to your systems.
- CRConrad 5y ago
  > This seems like irresponsible speculation and insinuating that Marek is about to commit a felony? No, it's speculation that Marek didn't do any of this, but that instead his account was hacked. You either responded to the wrong comment by mistake, or totally misunderstood the one you replied to.

zaroth 5y ago

This seems like irresponsible speculation and insinuating that Marek is about to commit a felony? I’d rather skip the character assassination based on hypothetical future actions please, and focus on what’s actually happened.

JimDabell 5y ago
> Packages are literally remote code exec vulns in the hands of package authors There are 20m+ weekly downloads of the colors package alone. He has what amounts to remote execution privileges to people using that package. When the subject of compromised packages comes up and he’s demonstrated that he’s willing to publish malicious updates, it’s completely fair to wonder what else he’s willing to do with that level of access to that many systems. It’s irresponsible not to consider what his packages can do to your systems.
CRConrad 5y ago
> This seems like irresponsible speculation and insinuating that Marek is about to commit a felony? No, it's speculation that Marek didn't do any of this, but that instead his account was hacked. You either responded to the wrong comment by mistake, or totally misunderstood the one you replied to.