4 ms·
This is a clever way to raise important issues in security of package managers, but I can't find support for your claim that NPM doesn't let you report malware.
by ivraatiems 5y ago
This is a clever way to raise important issues in security of package managers, but I can't find support for your claim that NPM doesn't let you report malware. A cursory google search brought me this: https://docs.npmjs.com/reporting-malware-in-an-npm-package https://docs.npmjs.com/reporting-malware-in-an-npm-package
And I confirmed that that button is indeed available on packages with a link that goes to eg https://www.npmjs.com/support?inquire=security&security-inquire=malware&package=left-pad&version=1.3.0 https://www.npmjs.com/support?inquire=security&security-inqu...
What functionality was removed?
- 1023bytes 5y agoI'm also seeing a "Report malware" button directly on the package page
- lhmiles 5y agoWhen I went to report vulnerabilities in two packages, I got a prompt "are you the maintainer of this package?". I hit no and it told me to go inform the maintainer.
- deleted 5y ago[deleted]
- ivraatiems 5y agoI'm not sure what to tell you. I submitted a report against your package and it went through and a security ticket was opened. Could you post some screenshots of what you are seeing?
- dschep 5y agoI suspect OP conflated "I am reporting malware in a package on npmjs.com" with "I have discovered a bug or vulnerability in a package on npmjs.com." The later shows what they report[0] whereas the former does allow for a report to be made. [0] https://imgur.com/VSZbZ0Q https://imgur.com/VSZbZ0Q