4 ms·

Who would actually use these packages? The README files are empty and the packages don't export anything. I don't see anyone using these by accident. I guess i

by jannes 3y ago

Who would actually use these packages? The README files are empty and the packages don't export anything. I don't see anyone using these by accident. I guess its meant to play a sick joke on some co-workers? https://www.npmjs.com/package/lodash-simple https://www.npmjs.com/package/lodash-simple https://www.npmjs.com/package/lodash_tailwind https://www.npmjs.com/package/lodash_tailwind

skrebbel 3y ago
I’ll never understand blog posts like these. I feel like I could make an npm package called “lodash-extra-turbo” that does nothing but shell out to call “rm -rf” and someone will write a blog post about how this evil npm package by a scary hacker will wipe your system.
- dEnigma 3y ago
  As suggested in the current top comment it could even be you who writes the blog post as well.
vasco 3y ago
I think the next step is creating a PR to another, higher profile package introducing a problematic dependency among other changes. It existing on its own doesn't prove intention of doing that, but it enables it. If I were doing this I'd start by creating an actually useful package and then later change it's behavior, but same principle. If you were just trying to get people to install it directly you'd go for name collisions / typos / namesquatting in your package name instead.
- vorticalbox 3y ago
  The trick is to change the package-lock. What you do it fork a popular package that the project uses and make some changes. Then update the package-lock so that it points to your GitHub fork. This file is normally ignored in PR due to the amount of line changes in there so you can have quite a bit of fun.
  - leipert 3y ago
    We‘ve been writing a tool to check lock files against the registry: https://www.npmjs.com/package/@gitlab/untamper-my-lockfile https://www.npmjs.com/package/@gitlab/untamper-my-lockfile For now it only supports yarn, but npm support shouldn’t be too hard.
    - louislang 3y ago
      This is really cool work, glad to see someone tackling this! Can I assume this will get rolled out into gitlab natively?
      - leipert 3y ago
        Actually good point, will talk to the respective PMs next week. Mainly been using it in CI in order to protect our own projects (thus yarn only for now)
arsome 3y ago
That or someone wrote them just for this blog post...
yafbum 3y ago
They're apparently named after a couple of popular actual npm packages, lodash and tailwindcss. So I guess it's possible some people will try these out as the "simple" version of lodash, or as the version that is meant to work with tailwindcss?
h1fra 3y ago
I think there is small but non-zero chance that someone might do it, and that's enough. Can easily happen if you were not paying attention when looking for a lodash in npmjs.com, or using the autocomplete on vscode, codesandbox that don't provide more context anyway. They could also write tutorial or stackoverflow answers linking those packages, it would definitely pass the moderation as the rest of the code would be okay and people copy/paste a lot. Or maybe they are just assessing what's possible. (or wrote for this article)
louislang 3y ago
We've seen a handful of individuals just go to PyPi or NPM and search for _something_ loosely related to what they need, and just blindly install it. I got a report yesterday of someone that did this with a Python package; similar setup: loosely related name, no README... guy still ran it.

by jannes 3y ago

skrebbel 3y ago

I’ll never understand blog posts like these. I feel like I could make an npm package called “lodash-extra-turbo” that does nothing but shell out to call “rm -rf” and someone will write a blog post about how this evil npm package by a scary hacker will wipe your system.

dEnigma 3y ago
As suggested in the current top comment it could even be you who writes the blog post as well.

vasco 3y ago

I think the next step is creating a PR to another, higher profile package introducing a problematic dependency among other changes. It existing on its own doesn't prove intention of doing that, but it enables it. If I were doing this I'd start by creating an actually useful package and then later change it's behavior, but same principle. If you were just trying to get people to install it directly you'd go for name collisions / typos / namesquatting in your package name instead.

vorticalbox 3y ago
The trick is to change the package-lock. What you do it fork a popular package that the project uses and make some changes. Then update the package-lock so that it points to your GitHub fork. This file is normally ignored in PR due to the amount of line changes in there so you can have quite a bit of fun.
- leipert 3y ago
  We‘ve been writing a tool to check lock files against the registry: https://www.npmjs.com/package/@gitlab/untamper-my-lockfile https://www.npmjs.com/package/@gitlab/untamper-my-lockfile For now it only supports yarn, but npm support shouldn’t be too hard.
  - louislang 3y ago
    This is really cool work, glad to see someone tackling this! Can I assume this will get rolled out into gitlab natively?
    - leipert 3y ago
      Actually good point, will talk to the respective PMs next week. Mainly been using it in CI in order to protect our own projects (thus yarn only for now)

arsome 3y ago

That or someone wrote them just for this blog post...

yafbum 3y ago

They're apparently named after a couple of popular actual npm packages, lodash and tailwindcss. So I guess it's possible some people will try these out as the "simple" version of lodash, or as the version that is meant to work with tailwindcss?

h1fra 3y ago

I think there is small but non-zero chance that someone might do it, and that's enough. Can easily happen if you were not paying attention when looking for a lodash in npmjs.com, or using the autocomplete on vscode, codesandbox that don't provide more context anyway. They could also write tutorial or stackoverflow answers linking those packages, it would definitely pass the moderation as the rest of the code would be okay and people copy/paste a lot. Or maybe they are just assessing what's possible. (or wrote for this article)

louislang 3y ago

We've seen a handful of individuals just go to PyPi or NPM and search for _something_ loosely related to what they need, and just blindly install it. I got a report yesterday of someone that did this with a Python package; similar setup: loosely related name, no README... guy still ran it.