5 ms·

New Protestware Found Lurking in Highly Popular NPM Package

14 points by aviramha 4y ago

aviramha 4y ago
Just found about it while releasing a package to VS Code marketplace - It appears we can't use the last versions of this package (es5-ext) anymore due to anti viruses marking it as a Hoax malware. I wonder what's people take here - should VirusTotal and anti viruses detect it as malware?
- hirundo 4y ago
  I think the malware designation is appropriate, though I support their cause. Malware detection should not be put in the position of deciding if a protest is righteous. If the change degrades the behavior of the package in a way that isn't relevent to its purpose, it is malware, regardless of who the malice targets. There may be a case for distributing malware to enemies, as speed bumps if not as weapons. But if we do that with the current distribution methods it will tend to remove whatever trust we have left in those systems. Which while unfortunate, is probably necessary. But removing the need for that trust will also remove it as a practical means of malware distribution, for good and ill. I'll go out on a limb and claim removing malware will be a net good.
  - aviramha 4y ago
    I think calling it malware might be wrong. Ultimately, what it does is display a message box when installing the package if Russian timezone. It doesn't cause any damage to the system, I can see how politically opposed person can be annoyed by it but that's a "valid" protest by an owner/creator IMO and I don't think it should be classified as malware...
    - hirundo 4y ago
      If the behavior of the software is unchanged and this is just an install message, then I agree.
filoeleven 4y ago
Two packages: styled-components and es5-ext. Both print out console messages on .ru systems, neither one messes with the system’s files.
stevenalowe 4y ago
Is this behavior listed as a feature of the package? If not, it’s malware.
- aviramha 4y ago
  It happens when you install the app, not during usage.
  - stevenalowe 4y ago
    Only slightly less irritating 'feature' that no one requested or was made aware of. Aberrant behavior of any kind erodes trust in the developer.
- aaron695 4y ago
dixie_land 4y ago
Let’s call it what it is - malware
throwaway_poop 4y ago

14 points by aviramha 4y ago

Just found about it while releasing a package to VS Code marketplace - It appears we can't use the last versions of this package (es5-ext) anymore due to anti viruses marking it as a Hoax malware. I wonder what's people take here - should VirusTotal and anti viruses detect it as malware?

hirundo 4y ago
I think the malware designation is appropriate, though I support their cause. Malware detection should not be put in the position of deciding if a protest is righteous. If the change degrades the behavior of the package in a way that isn't relevent to its purpose, it is malware, regardless of who the malice targets. There may be a case for distributing malware to enemies, as speed bumps if not as weapons. But if we do that with the current distribution methods it will tend to remove whatever trust we have left in those systems. Which while unfortunate, is probably necessary. But removing the need for that trust will also remove it as a practical means of malware distribution, for good and ill. I'll go out on a limb and claim removing malware will be a net good.
- aviramha 4y ago
  I think calling it malware might be wrong. Ultimately, what it does is display a message box when installing the package if Russian timezone. It doesn't cause any damage to the system, I can see how politically opposed person can be annoyed by it but that's a "valid" protest by an owner/creator IMO and I don't think it should be classified as malware...
  - hirundo 4y ago
    If the behavior of the software is unchanged and this is just an install message, then I agree.

filoeleven 4y ago

Two packages: styled-components and es5-ext. Both print out console messages on .ru systems, neither one messes with the system’s files.

stevenalowe 4y ago

Is this behavior listed as a feature of the package? If not, it’s malware.

aviramha 4y ago
It happens when you install the app, not during usage.
- stevenalowe 4y ago
  Only slightly less irritating 'feature' that no one requested or was made aware of. Aberrant behavior of any kind erodes trust in the developer.
aaron695 4y ago

dixie_land 4y ago

Let’s call it what it is - malware

throwaway_poop 4y ago