4 ms·

Most people had no idea they even use colors.js as it’s used by some dependency of some dependency. For example, anyone installing AWS CDK afresh would be unabl

by e1g 5y ago

Most people had no idea they even use colors.js as it’s used by some dependency of some dependency. For example, anyone installing AWS CDK afresh would be unable to deploy their infrastructure - it uses colors.js, which blocks the CPU as soon as it’s require’d deep in the stack. With that rug pull, the library author intended, designed, and successfully accomplished a Denial of Service move against all those people.

brigandish 5y ago
> Most people had no idea they even use colors.js Why is that? Do NPM package managers not create a lock file that is a text file anyone can peruse?
- fault1 5y ago
  yeah, it's just nobody reads every package in that file. apps generated via create-react-app have more than 2000+ transitive dependencies.
  - deleted 5y ago
    [deleted]
  - syshum 5y ago
    That is a design problem of npm and really the nodejs dev community in general. They (you) are Blaming the dev because inherent design flaws in their development methodology. People have been pointing out this problem with npm for years and years
krab 5y ago
> Most people had no idea they even use colors.js Isn't that the problem? That they were running a lot of code from unpaid contributors without any guarantees (as said explicitly in the license) and then blaming those contributors when something breaks?
- lolinder 5y ago
  Yes, it's a huge problem. But the author here is absolutely at fault for this attack. If I leave my garage door wide open all night and a bunch of stuff gets stolen, I'll kick myself for stupidity and vow not to do it again. I'll also call the police and hope they find the perpetrator, because there was a theft. It is true that we as a profession need to drastically rethink our approach to dependencies and also that this author acted unprofessionally and should be condemned for his actions.
  - xvector 5y ago
    > If I leave my garage door wide open all night and a bunch of stuff gets stolen It's more like, "I let some random guy do whatever he wants to my garage door and he decides to brick it."

by e1g 5y ago

brigandish 5y ago

> Most people had no idea they even use colors.js Why is that? Do NPM package managers not create a lock file that is a text file anyone can peruse?

fault1 5y ago
yeah, it's just nobody reads every package in that file. apps generated via create-react-app have more than 2000+ transitive dependencies.
- deleted 5y ago
  [deleted]
- syshum 5y ago
  That is a design problem of npm and really the nodejs dev community in general. They (you) are Blaming the dev because inherent design flaws in their development methodology. People have been pointing out this problem with npm for years and years

krab 5y ago

> Most people had no idea they even use colors.js Isn't that the problem? That they were running a lot of code from unpaid contributors without any guarantees (as said explicitly in the license) and then blaming those contributors when something breaks?

lolinder 5y ago
Yes, it's a huge problem. But the author here is absolutely at fault for this attack. If I leave my garage door wide open all night and a bunch of stuff gets stolen, I'll kick myself for stupidity and vow not to do it again. I'll also call the police and hope they find the perpetrator, because there was a theft. It is true that we as a profession need to drastically rethink our approach to dependencies and also that this author acted unprofessionally and should be condemned for his actions.
- xvector 5y ago
  > If I leave my garage door wide open all night and a bunch of stuff gets stolen It's more like, "I let some random guy do whatever he wants to my garage door and he decides to brick it."