←back to thread

NPM debug and chalk packages compromised

(www.aikido.dev)
1369 points universesquid | 8 comments | 08 Sep 25 15:37 UTC | HN request time: 0.43s | source | bottom
Show context
nromiun ◴[08 Sep 25 16:19 UTC] No.45170180[source]▶
I have nothing to do with this but still I am getting second hand embarrassment. Here is an example, is-arrayish package, 73.8 MILLION downloads per week. The code? 3 lines to check if an object can be used like an array.

I am sorry, but this is not due to not having a good standard library, this is just bad programming. Just pure laziness. At this point just blacklist every package starting with is-.

replies(5): >>45170288 #>>45170925 #>>45172151 #>>45173397 #>>45175092 #
1. zahlman ◴[08 Sep 25 16:27 UTC] No.45170288[source]▶
Meanwhile in Python: 134 million weekly downloads, seemingly slowly trending upward over time, for https://pypistats.org/packages/six which provides third-party compatibility for a version of Python that dropped support over five years ago.
replies(3): >>45170340 #>>45172271 #>>45175962 #
2. nromiun ◴[08 Sep 25 16:31 UTC] No.45170340[source]▶
The code is 813 lines [0]. Not saying everyone should use it but these two are not directly comparable.

[0] https://github.com/benjaminp/six/blob/main/six.py

replies(1): >>45170386 #
3. zahlman ◴[08 Sep 25 16:34 UTC] No.45170386[source]▶
It is much more code, but it should be even more useless. (No slight intended to Benjamin Peterson.) The 2.7 window was already extended to give everyone a chance to migrate.
4. sega_sai ◴[08 Sep 25 18:54 UTC] No.45172271[source]▶
Most of these downloads, I would bet, are from CI
replies(1): >>45173642 #
5. zahlman ◴[08 Sep 25 20:36 UTC] No.45173642[source]▶
Oh, I don't doubt it at all. But that doesn't make it any less depressing to me. Nor does it matter to Fastly's bandwidth burden.
6. rtpg ◴[09 Sep 25 00:31 UTC] No.45175962[source]▶
Was a bit surprised at this, but looking into the packages in a work project that require six, a _huge_ chunk of them are packages that are still explicitly supporting Python 2.7 still (usually stuff related to operations).

I believe if you pay money to certain repo maintainers like red hat you can still have a supported version of Python 2.7.

replies(1): >>45182682 #
7. zahlman ◴[09 Sep 25 14:48 UTC] No.45182682[source]▶
> a _huge_ chunk of them are packages that are still explicitly supporting Python 2.7 still

Do you know if they also support 3.x?

Do you know if they're available on PyPI?

> (usually stuff related to operations).

What kind of "operations" do you mean?

replies(1): >>45191719 #
8. rtpg ◴[10 Sep 25 00:55 UTC] No.45191719{3}[source]▶
yes they also support python 3.x, are available on PyPI, and are related to operations in the sense of like... infrastructure management and the like.

You have a huge pile of "sysop Python" out there interfacing with various infrastructure providers who are more interested in selling infra usage than getting off of Python 2.

"In order to use our new storage service via our library you need to upgrade to Python 3 first" "ehhhhhhhh kinda annoying"

That interaction has happened in the past. Time marches forward of course but.