←back to thread

Tell HN: Camelgate NPM Outage (Cloudflare)

119 points bavarianbob | 4 comments | 01 Apr 25 16:19 UTC | HN request time: 0.641s | source

EDIT: Back online?!

NPM discussion: https://github.com/npm/cli/issues/8203

NPM incident: https://status.npmjs.org/incidents/hdtkrsqp134s

Cloudflare messaging: https://www.cloudflarestatus.com/incidents/gshczn1wxh74

GitHub issue: https://github.com/sindresorhus/camelcase/issues/114

Anyone experiencing npm outage that's more than just the referenced camelcase package?

Show context
tom_usher ◴[01 Apr 25 16:38 UTC] No.43548817[source]▶
Seems to be a change in Cloudflare's managed WAF ruleset - any site using that will have URLs containing 'camel' blocked due to the 'Apache Camel - Remote Code Execution - CVE:CVE-2025-29891' (a9ec9cf625ff42769298671d1bbcd247) rule.

That rule can be overridden if you're having this issue on your own site.

replies(3): >>43549123 #>>43550078 #>>43550699 #
oncallthrow ◴[01 Apr 25 18:38 UTC] No.43550078[source]▶
WAFs are so shit
replies(2): >>43550728 #>>43552419 #
ronsor ◴[01 Apr 25 19:57 UTC] No.43550728[source]▶
WAFs are literally "a pile of regexes can secure my insecure software"
replies(2): >>43551360 #>>43555585 #
1. mschuster91 ◴[01 Apr 25 21:07 UTC] No.43551360[source]▶
To be fair to WAFs, most are more than just a pile of regexes. Things like detecting bot traffic - be it spammers or AI scrapers - are valuable (ESPECIALLY the AI scraper detection, because unlike search engines these things have zero context recognition or respect for robots.txt and will just happily go on and ingest very heavy endpoints), and the large CDN/WAF providers can do it even better because they can spot shit like automated port scanners, Metasploit or similar skiddie tooling across all the services that use them.

Honestly what I'd _love_ to see is AWS, GCE, Azure, Fastly, Cloudflare and Akamai band together and share information about such bad actors, compile evidence lists and file abuse reports against their ISP - or in case the ISP is a "bulletproof hoster" or certain enemy states, initiate enforcement actors like governments to get these bad ISPs disconnected from the Internet.

replies(1): >>43553871 #
2. randunel ◴[02 Apr 25 05:22 UTC] No.43553871[source]▶
Why would scrapes get blocked, is scrapping illegal?
replies(2): >>43554078 #>>43554375 #
3. eitland ◴[02 Apr 25 06:15 UTC] No.43554078[source]▶
I don't know if it is, but I also don't think we are required to let dumb bots repeatedly assault or web sites if we can find a technical way to get around it.
4. Xylakant ◴[02 Apr 25 07:17 UTC] No.43554375[source]▶
It's very often not, but it's still the website owners property and if they choose so, they can show misbehaving guests the door and kindly ask to remain on the other side (aka block them). Large scale scraping puts substantial burden on web properties. I was paged the other night because someone decided it would be a great idea to throw 200 000rq/s for a few minutes at some publicly available volunteer run service.