4 ms·
The package uses https://github.com/RIAEvangelist/peacenotwar https://github.com/RIAEvangelist/peacenotwar to deliver the message. But I don't understand why/h
by mfcl 5y ago
The package uses https://github.com/RIAEvangelist/peacenotwar https://github.com/RIAEvangelist/peacenotwar to deliver the message.
But I don't understand why/how it would wipe the PC. Unless I missed something, the code from the package does not delete anything.
> This code serves as a non-destructive example of why controlling your node modules is important. It also serves as a non-violent protest against Russia's aggression that threatens the world right now.
Nah, the author knew it's would be controversial. The first sentence is there as an excuse.
- ammo1662 5y agoSome details here https://gist.github.com/MidSpike/f7ae3457420af78a54b38a31cc0c809c https://gist.github.com/MidSpike/f7ae3457420af78a54b38a31cc0... It does not delete anything, just rewrite them.. Which is much more terrible than just deleting.
- shortstuffsushi 5y agoI think there's some history rewriting going on here, as a different version of the code (9.2.2) which apparently contained the malicious code was linked to from another GitHub issues, but that version no longer exists in the git history.
- supermatt 5y agoThats the more recent version. The original had some obfuscated code in the main repo that overwrote all files.