SIsimias·Nov 27, 2018
I'm not familiar with the Node ecosystem but people blaming the
maintainer for giving control of one of his unmaintained repos to
a third party is frankly ludicrous to me. I mean, why did you
even trust the original maintainer in the first place? How do you know that
if somebody had decided to pay him a million dollar to backdoor
his package, he wouldn't have done it? Did you pay a private eye
to conduct a private investigation on them?
If the other dev who injected the backdoor had waited a year or
so, pretending to actually maintain the package first, what then?
If you're writing code dealing with sensitive information (say,
credit card, cryptocurrency credentials, private information
etc...) and you don't even bother to vet your dependencies and
when it blows in your face your first reflex is to shift blame on
some guy who's giving you
Read the rest
r source code free on the internet you
should really think hard about what you're doing.
Can you imagine that flying in any other industry? "Bridge
collapses because company bought crappy steel from some guy off
e-bay, but hey he had a trustworthy nickname."
I mean, the injection was finally discovered because of a
deprecation warning:
https://github.com/remy/nodemon/issues/1442
I wonder how many backdoored node packages there are out there,
but judging by how this issue was handled I'd guess probably more
than 0.
If there's one positive consequence to this cryptocurrency craze it's that it shines light on our terrible so-called "engineering" practices in the software industry.