3 ms·

I don't think it was ever a link to an explanation. It's just a link to the Github advisories page with a search query for 'no-one-left-behind' attached: www.np

I don't think it was ever a link to an explanation. It's just a link to the Github advisories page with a search query for 'no-one-left-behind' attached: www.npmjs.com/advisories?search=no-one-left-behind. It's the equivalent of linking to a Google search. Given the number of bots uploading malicious packages, I wouldn't be surprised if this is mostly all automated, and there's no manpower available to dedicate to descriptions of each shady package uploaded to the world's largest package repository. If this were a vulnerability in the infrastructure of NPM itself, then I would definitely expect a full writeup with a working link.

aftbit 3y ago
Okay, well... then it is broken in THREE ways. First, the link no longer leads to the search, as the redirect seems to strip the parameters. Second, searching the github for "no-one-left-behind" gives no results. Third, this _is_ a vulnerability of the NPM ecosystem, as shown by the fact that this happened _AGAIN_ this week.
- throwitaway1123 3y ago
  > First, the link no longer leads to the search, as the redirect seems to strip the parameters. Github acquired NPM, and now they're trying to integrate NPM with all of Github's products, so NPM advisories now link to the Github advisories page, which is probably why the search query is being stripped. This is definitely not ideal, but I would probably characterize this as corporate ineptitude. Classic case of a company acquiring a smaller company and not properly handling the integration. > Second, searching the github for "no-one-left-behind" gives no results. Like I said, there are bots publishing malicious packages faster than human reviewers can even describe them, so I don't expect a full write up for every prank package. Are you really upset that you had to Google the package instead of following a link in a package's description? Really? Would you instantly mistrust any organization with a link that lead to a 404 page? > Third, this _is_ a vulnerability of the NPM ecosystem, as shown by the fact that this happened _AGAIN_ this week. I would hardly characterize this as a vulnerability of the NPM ecosystem. I'm not even sure if this would warrant its own CVE. You act as if the package was installing bitcoin miners on developer machines. Like I said, if this were a vulnerability in the infrastructure of NPM itself (say for instance it managed to hack the servers hosting NPM), then I would definitely expect a full write up. All it's doing is preventing people from unpublishing packages. It was honestly a curtesy of NPM to even take it down. If it was up to me I might make the whole registry immutable. Another commenter said it best: "In any case this is a mild inconvience at most. Anyone who gets upset over this needs to go touch grass."[1] [1] https://news.ycombinator.com/item?id=38883067 https://news.ycombinator.com/item?id=38883067

aftbit 3y ago

Okay, well... then it is broken in THREE ways. First, the link no longer leads to the search, as the redirect seems to strip the parameters. Second, searching the github for "no-one-left-behind" gives no results. Third, this _is_ a vulnerability of the NPM ecosystem, as shown by the fact that this happened _AGAIN_ this week.

throwitaway1123 3y ago
> First, the link no longer leads to the search, as the redirect seems to strip the parameters. Github acquired NPM, and now they're trying to integrate NPM with all of Github's products, so NPM advisories now link to the Github advisories page, which is probably why the search query is being stripped. This is definitely not ideal, but I would probably characterize this as corporate ineptitude. Classic case of a company acquiring a smaller company and not properly handling the integration. > Second, searching the github for "no-one-left-behind" gives no results. Like I said, there are bots publishing malicious packages faster than human reviewers can even describe them, so I don't expect a full write up for every prank package. Are you really upset that you had to Google the package instead of following a link in a package's description? Really? Would you instantly mistrust any organization with a link that lead to a 404 page? > Third, this _is_ a vulnerability of the NPM ecosystem, as shown by the fact that this happened _AGAIN_ this week. I would hardly characterize this as a vulnerability of the NPM ecosystem. I'm not even sure if this would warrant its own CVE. You act as if the package was installing bitcoin miners on developer machines. Like I said, if this were a vulnerability in the infrastructure of NPM itself (say for instance it managed to hack the servers hosting NPM), then I would definitely expect a full write up. All it's doing is preventing people from unpublishing packages. It was honestly a curtesy of NPM to even take it down. If it was up to me I might make the whole registry immutable. Another commenter said it best: "In any case this is a mild inconvience at most. Anyone who gets upset over this needs to go touch grass."[1] [1] https://news.ycombinator.com/item?id=38883067 https://news.ycombinator.com/item?id=38883067