3 ms·
What the hell are NPM and GitHub doing, are they letting this malware exist since it's for the "right" cause? I understand where this guy's heart is at but this
by 4oo4 5y ago
What the hell are NPM and GitHub doing, are they letting this malware exist since it's for the "right" cause? I understand where this guy's heart is at but this is wrong on so many levels. I reported this to both of them this morning, and they are still up, I can't be the only one. If they don't take it down then that is a serious trust issue there, and represents a new reality where people will willingly host malware if it's for the correct political cause.
I forked the repo to make the README.md more accurate and satirical (and removed the actual malicious code), but sadly I can't make a PR since he's locked down the repository to only contributors.
https://github.com/4oo4/cyberwarfareispeace https://github.com/4oo4/cyberwarfareispeace
But seriously GitHub and NPM, get your shit together.
EDIT: Finally got a response back from NPM and GitHub that they're investigating.
- 4oo4 5y agoOK this gets worse. GitHub acknowledged this as malware two days ago but still allows this guy to keep using the platform: https://github.com/advisories/GHSA-97m3-w2cp-4xx6 https://github.com/advisories/GHSA-97m3-w2cp-4xx6 I asked them for clarification.