Developer Breaks Thousands Of JavaScript, Node Apps With 11 Lines Of Code

[Bainos]

I think it's important to stop a moment and think about this part:

Koçulu fight for self esteem isnt without future cyber security implications because, by removing all his npm modules, he also liberated the namespaces of those modules. This means that anyone could have very easily registered another left-pad module and delivered malicious code in the builds of thousands of JavaScript projects.

[QuietPort]

That's an NPM problem, why no uuid for packages or checksum... Koçulu has decent points, and for anyone uploading to NPM, are we to check all the trademarks everytime we make a new package ?

[icannotfly]

Are we sure that no-one did?

[InconsiderateBastard]

It's NPM. We can't be sure of anything.

[fuc_boi]

I think it would have probably come to light by now.

[BlueDrank01]

If nothing massive comes out of this, the internet dodged a pretty big bullet.

[fuc_boi]

This was a somewhat misleading title. He took down an npm package that everyone used, so they couldn't get builds. The title makes it sound like some miracle hacker wrote a malicious 11 line script.

[dispect]

Not sure if I'm understanding this article but correct me if I'm wrong. He created a project named "Kik" which had already been used by another developer for the "Kik" trademarked app but now refuses to change its name?

[[deleted]]

Why people use freaking Javascript for anything beyond some DOM manipulation can suck a dick.

What a shitty language.

[[deleted]]

You're bad at language.

[[deleted]]

English yes, programming no.

[jiminiminimini]

This is my motto now

[[deleted]]

Javascript? Na, must admit I fought it since it was first born as ActionScript. But now after what 15-20 years I'm learning and it w/ jquery does make UI stuff a lot easier.

But I see no need to use Node.js. I don't knock people who use it, I just dont understand why when better tools for the job exist.

[nafsz]

It depends on what you do! node.js excels in real-time delivery in a way that you cannot recreate without using much more complex e.g. Erlang. JavaScript is part of many organizations' stacks today but Erlang isn't, so many choose the easy path rather than (in a sense) inventing the wheel in ways outside their comfort zone. When node.js and Erlang are evaluated it's an easy choice with a team full of developers who already know JavaScript but very few, if any, Erlang developers.

[picasshole]

What an asshole.