This repository has been archived by the owner on Jun 14, 2018. It is now read-only.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This was removed from npm and replaced with the "security holder module" - why add it as a dependency?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Admittedly this was a somewhat underhanded attempt for me to demonstrate how one could fairly easily create a worm in
npm
. This package gets a lot of accidental installs. My oldpeabnuts123s-evil-module
used to install itself as a primary dependency upon being installed as any level of subdependency. It did nothing malicious, just installed itself as a proof of concept around the security of npm and JavaScript's dependency culture. My package got cleaned up in a sweep npm did of their repository sometime last year due to the way it was linked to some other packages and I was unable to get it reinstated.If you would be interested in allowing me to recreate this demonstration I could create another package and update my Pull Request. I am very concerned that somebody with malicious intent will pull off something like this and compromise hundreds of thousands of peoples packages, computers, networks etc. at some point in the future. Feel free to message me on Twitter @peabnuts123 or email me on peabnuts123@gmail.com if you want me to talk you through more of this. I gave a presentation at a conference, "Kiwicon", in 2016 to around ~2k people on this and would love to raise awareness further, given the opportunity. Thanks!