3 ms·

> vandalism is simply never okay Neither is invading another country. Someone didn't delete the files. You deleted them yourself by blindly trusting 3rd party

• grishka 5y ago
  > Neither is invading another country. Indeed. Except, did I elect this president? No I did not (and elections in Russia are more of an illusion anyway). Can I do something to stop him? No I can't. What's the point of this act then? Putin and his allies don't use npm. This can't affect them by any stretch of imagination. > Someone didn't delete the files. You deleted them yourself by blindly trusting 3rd party software that you got for free with no guarantees of anything. Yes, of course, npm is at fault here for downloading untrusted code and running it with no sandboxing whatsoever on behalf of your OS user. This kind of stuff used to be called an RCE vulnerability and used to cause people to issue urgent security patches, but somehow, now it's considered a perfectly normal way of doing things. At the very least, there should be a permission request if this untrusted code tries to access anything outside of the project directory.