11 ms·
My entire PC got wiped Do not download
- forgotpwd16 5y agoChecking source of module all it does is make a file in desktop. That the issue opener has a troll face as avatar doesn't help in taking their claim serious.
- pastacacioepepe 5y agoIt previously altered the file system by adding a file in every folder and causing issues. That version was then reverted with the current one that only adds a file to the desktop. https://github.com/RIAEvangelist/node-ipc/issues/390 https://github.com/RIAEvangelist/node-ipc/issues/390
- deleted 5y ago[deleted]
- phone8675309 5y agoThis was documented and discussed here yesterday: https://news.ycombinator.com/item?id=30717382 https://news.ycombinator.com/item?id=30717382 and https://news.ycombinator.com/item?id=30703817 https://news.ycombinator.com/item?id=30703817
- x86_64Ubuntu 5y agoThis is brutal. I can only imagine the indignation felt if US computers were wiped because of the 2003 invasion.
- anonymouswacker 5y ago
- smt88 5y agoDo you feel that there are no significant differences between the invasion of Iraq and the wars in Ukraine that started in 2014?
- opisthenar84 5y agoThe invasion of Iraq took place over weapons that did not exist. The invasion of Ukraine is happening because of non-existent neo-Nazis in the Ukrainian government. Not identical, but there are parallels.
- smt88 5y agoI didn't deny that there are parallels. I asked if they are the same, and you seem to agree that they aren't.
- pokepim 5y agoIs it fair to compare which war was worse? The suffering is same anywhere, or do you mean that brown peoples lives are less important? If that is the case then this is really fucked up.
- smt88 5y agoI am brown, so you can take your insinuation that I'm a white supremacist elsewhere. Try to address what I actually said instead of putting words in my mouth. I'm not arguing about it on a humanitarian basis. The invasion of Iraq and subsequent forever-war is a huge humanitarian disaster that Putin may or may not beat. I'm arguing about whether Putin invading a peaceful, democratic country in order to expand his borders is more or less justified than the US invading a hostile, murderous dictatorship. Both are bad, but one is clearly worse.
- sschueller 5y agoI'm sorry but Ukraine was not peaceful before the invasion. There was extensive fighting in the east over years. External entities where funding various factions and the previous government was a puppet. You paint Ukraine as some peaceful and stable European place when it just factually wasn't. If Russia invaded Finland I would agree with you but nut Ukraine.
- smt88 5y agoUS computers are attacked by foreign nations all the time.
- sally1620 5y agoNext time someone asks me why you are writing a function yourself instead of using a library, I will show them this.
- 0des 5y agoI spent all of 2021 with a challenge to myself to do stdlib only, and though at first it was challenging, it was great! I learned so much that using a library now seems like tying a cow to my neck to make a bowl of cereal
- mfcl 5y agoThe package uses https://github.com/RIAEvangelist/peacenotwar https://github.com/RIAEvangelist/peacenotwar to deliver the message. But I don't understand why/how it would wipe the PC. Unless I missed something, the code from the package does not delete anything. > This code serves as a non-destructive example of why controlling your node modules is important. It also serves as a non-violent protest against Russia's aggression that threatens the world right now. Nah, the author knew it's would be controversial. The first sentence is there as an excuse.
- ammo1662 5y agoSome details here https://gist.github.com/MidSpike/f7ae3457420af78a54b38a31cc0c809c https://gist.github.com/MidSpike/f7ae3457420af78a54b38a31cc0... It does not delete anything, just rewrite them.. Which is much more terrible than just deleting.
- shortstuffsushi 5y agoI think there's some history rewriting going on here, as a different version of the code (9.2.2) which apparently contained the malicious code was linked to from another GitHub issues, but that version no longer exists in the git history.
- supermatt 5y agoThats the more recent version. The original had some obfuscated code in the main repo that overwrote all files.
- jaxrtech 5y agoMy guess is that the npm package itself got hijacked? The latest version on npm is v11.1.0 (updated 3 days ago) while master on GitHub is v10.1.0 (updated 9 months ago).
- jeroenhd 5y agoNo, this was intentional. The author added the peacenotwar package to the dependencies and bumped the version a bunch of times to trigger automatic dependency updates. This is why you should pin dependencies, but good luck keeping up with that in modern Javascript dependency hell where every framework pulls in half a gigabyte of dependencies.
- chii 5y agoregardless of the goals, malware is malware. I think there's an overton window here which is getting pushed. People need to stop unilaterally imposing their own form of punishment to a group of people, just to make a political statement. It was bad with the BLM saga, but apparently at the time, it was too politically incorrect to say. It is still bad now that the russian invasion is causing an even wider and larger number of such malware. Make political statements with your government, or do it as a standalone organization. Put ads in the papers, media etc. Don't use an unrelated platform, such as software distribution platforms to make a political statement - esp. if it harms the end user in some ways. There's a name for such action - it's called terrorism. I would hope that the people living in civilized society can see that.
- sascha_sl 5y agoI'm sorry, I don't remember the time someone added a dependency to all their packages that turns on your webcam and uses a shoddily trained neural net to determine if you were black enough to not have your hard drive wiped? License changes are not malware.
- systemvoltage 5y agoWhat's more worrying is the corporate take over. Every citizen including CEOs and employees have the right to speak in the public sphere as private citizens, but what they cannot do is leverage the position/influence as corporations, bypass the checks/balances of election in a democracy and wield extraordinary power over the society, impose their beliefs on the rest of us. A small group of people in Silicon Valley influences the belief system of the rest of the world. I think we're going to see a rise of non-woke corporations after the public is fed up. But until then, we're stuck with it. There is a massive silent majority that put up with it because their jobs are on the line.
- julianlam 5y ago> non-woke corporations They never went away, you just don't hear about them because they don't publicly pat themselves on the back every time they signal their virtue...
- anthropodie 5y agoI want to mitigate risks like this. Is there a way to limit access to certain directories only while using certain software?
- warmwaffles 5y agoYes, don't give your main account admin sudo access without a password. Keep backups on an external file store just in case. Use a filesystem that has snapshot capabilities.
- Gigachad 5y agoWhat is the point of that. Sudo doesn't give access to anything important. Very much reminds me of this https://xkcd.com/1200/ https://xkcd.com/1200/ Snapshots on an external system is useful but few are disciplined enough to take regular enough snapshots.
- randomhodler84 5y agoIt kinda does… root can write to places that the user cannot. Like Boot partitions, or entire device nodes, or load kernel modules that the user cannot see. That xkcd is a funny historical joke, but the root/user distinction is still a critical part of operating system security today.
- derkades 5y agoBut it is true. Who cares if the program can write to your system configuration when it can encrypt your entire home directory and use your private SSH keys to encrypt all your servers as well. I'd argue the root/normal user separation is largely useless on single user desktop computers.
- randomhodler84 5y agoPresumably only the homedirs of the servers. You want a world where a browser exploit can drop a bootkit? Nahhh
- seanw444 5y agoThe Issues for node-ipc have devolved so much, and it's completely hilarious and entertaining to read.
- seanw444 5y agoAt least with Faker.js, it didn't act as malware. Simply a deleted project. That was a more respectable protest. This... well it's certainly an attention-grabber. But if he wants people to be sympathetic to his message, good luck with that now.
- spacemanmatt 5y agoIs seanw444 available as a service or do malware authors have to just guess what will merit your respect?
- DoctorOW 5y agoFirst time seeing something criticized?
- spacemanmatt 5y agoFirst time seeing a critical comment counter-critiqued?
- aaron695 5y ago
- opisthenar84 5y agoPeople frequently forget that the actions of one's government do not necessarily represent an individual's standpoint. Go after high-level officials and oligarchs, but do not go after common folk - they've already lost enough.
- deleted 5y ago[deleted]
- s1artibartfast 5y agoNot necessarily but they are frequently morally culpable. The problem is that Collective punishment is indiscriminate. It makes no effort to discern between active objector and protester and a supporter. Probabilistic Justice isn't just
- crazypython 5y agothis only gives the kremlin the ability o say "The West is out to get you"
- deleted 5y ago[deleted]
- vmception 5y agoCheck out the other "Issues" there, its going wild!
- StringyBob 5y agoI have no idea who or what to believe, but there is a quote from someone claiming to be a NGO documenting war crimes that has had their records wiped by this https://github.com/IdealismIncinerator/node-ipc/blob/master/README.md https://github.com/IdealismIncinerator/node-ipc/blob/master/...
- imtringued 5y agoIf war is bad why fight a cyberwar as a civillian?
- 0x38B 5y agoThis is disgusting and thoughtless, because it accomplishes nothing but alienating Russian or Belarusian users. It doesn’t attempt to spread the truth or convince people that yes, Russian forces really are committing war crimes. Killing children. I would love for pro-“special operation” Russians to find out why Ukrainian hospitals in the war zone keep their lights off at night. Hint: so they won’t be targeted. Spreading those truths could have done some good, but this… this is merely malicious.
- rosndo 5y ago> This is disgusting and thoughtless, because it accomplishes nothing but alienating Russian or Belarusian users. It doesn’t attempt to spread the truth or convince people that yes, Russian forces really are committing war crimes. Killing children. You could say exactly the same about economic sanctions, no? The idea that spreading information about Russian war crimes in Ukraine will somehow lead to a popular uprising is really far fetched.
- tored 5y agoWhen Wikileaks spread information about US war crimes in Iraq it didn’t lead to any uprising in the US at all, protest yes but no uprising. The regime got re-elected. Instead what did happened was the imprisonments of the journalist Julian Assange. In the age we live in most citizens, in any country, are powerless, if you peacefully speak up against your own regime you will be doxxed, silenced, arrested, your bank accounts frozen and even be classified as a terrorist. This have been the case in authoritarian countries but now also is common in so called democratic countries too. Thinking that you create massive change in another country by putting sanctions on that citizenry is naive, not only will they be punished for the sanctions itself but also when speaking up.
- samhw 5y ago> if you peacefully speak up against your own regime you will be doxxed, silenced, arrested, your bank accounts frozen and even be classified as a terrorist > this ... now also is common in so called democratic countries too Uh, in what democratic countries, exactly?
- jmrm 5y agoHave the creator thought that a Russian or a Belorussian person who use this software might are against the government or their country? Blaming citizens who are mostly uninformed and mislead due to information control, and have little real power to change what's happening, doesn't help at all to the current situation.
- tored 5y agoMe prophetically 2 days ago > software developers are smart enough to not download crap from the internet, but they will gladly run npm install with full user privileges. https://news.ycombinator.com/item?id=30684416 https://news.ycombinator.com/item?id=30684416
- mkeeter 5y agoThe node-ipc supply-chain attack also made its way into Unity, albeit in the milder "leave a file on the desktop" form: https://twitter.com/hybridherbst/status/1504223953627369480 https://twitter.com/hybridherbst/status/1504223953627369480
- orangepurple 5y agoThanks for all the free pizza, and thanks to all the police that showed up to SWAT me. They were really nice fellas. https://github.com/RIAEvangelist/node-ipc/commit/088a1ca4d5fe5d175c43ee41718b72b017f6f6a4 https://github.com/RIAEvangelist/node-ipc/commit/088a1ca4d5f...
- voldacar 5y agoFrom github tos: >We do not allow anyone to use our platform in direct support of unlawful attacks that cause technical harms, such as using GitHub as a means to deliver malicious executables or as attack infrastructure Why are they still hosting this? It would seem to violate the CFAA and therefore be unlawful
- stagas 5y agoYou can mitigate against those kinds of attacks using npm's `--before` option: npm i --before=`date -I -d '-5 days'` It will only install packages released before the specified date.
- samhw 5y agoI think this is engendering a false sense of security. NPM's awful documentation doesn't specify whether it's possible for a dependency published 1 year ago to install, via a wildcard [transitive] dependency, a dependency updated today[0]. I have absolutely zero faith in the NPM devs' having considered this. [0] In fact, it doesn't specify this flag at all. Nor does the command line help, or man page. It doesn't say a word about this, and it appears the only way to determine the semantics of this flag is to run it.
- sschueller 5y agoThis package should be immediately removed from the npm repository and the developer should be permanently banned from publishing npm packages. If you purposely distribute malware you don't get to be part of the package registry as you have proven you can't handle the responsibility.
- jbjohns 5y agoThis was a criminal act. They should get more than just banned from some repos.
- 4oo4 5y agoWhat the hell are NPM and GitHub doing, are they letting this malware exist since it's for the "right" cause? I understand where this guy's heart is at but this is wrong on so many levels. I reported this to both of them this morning, and they are still up, I can't be the only one. If they don't take it down then that is a serious trust issue there, and represents a new reality where people will willingly host malware if it's for the correct political cause. I forked the repo to make the README.md more accurate and satirical (and removed the actual malicious code), but sadly I can't make a PR since he's locked down the repository to only contributors. https://github.com/4oo4/cyberwarfareispeace https://github.com/4oo4/cyberwarfareispeace But seriously GitHub and NPM, get your shit together. EDIT: Finally got a response back from NPM and GitHub that they're investigating.
- 4oo4 5y agoOK this gets worse. GitHub acknowledged this as malware two days ago but still allows this guy to keep using the platform: https://github.com/advisories/GHSA-97m3-w2cp-4xx6 https://github.com/advisories/GHSA-97m3-w2cp-4xx6 I asked them for clarification.
- rusnoob 5y agoMicrosoft maintains GitHub. This is water on their mill. Use solid, corporate backed dotnet, not random soyware. Next you know FOSS is dead in the water. If one random supporter of the current thing can cause such a mayhem, imagine what can happen to any of the projects in 2-3 years: you run update and find your sever wiped out because capitalism is bad or indigenous people of Tuvalu lost a fishing boat or whatever. On the longer run this is the end of community projects in mission critical applications. You are one brain damaging soy latte away from total distaster.
- samhw 5y agoUh, .NET is free open-source software. Have a look at this 1500-line package-lock.json: https://github.com/dotnet/runtime/blob/main/src/mono/wasm/runtime/package-lock.json https://github.com/dotnet/runtime/blob/main/src/mono/wasm/ru... And even if you ignore that: what about the browser you use to install it? The library you use to decompress the file? The library you use to checksum it? The dependencies you install when you write code in .NET (which is the entire problem here and is literally no different whatsoever in .NET, aside perhaps from differences in the size of their standard libraries)? I'm sorry, you're right to say that this is wrong and that the ease of installing malware is terrifying (and not nearly enough acknowledged), but there's no lazy magic bullet that will save you. Welcome to combinatorial explosion!