The developer responsible for breaking the integrity of this commonly used software package is known as Brandon Nozaki Miller. It is public information that he is the maintainer. I think we will have to wait for him to announce if he personally did this or was hacked.
TURN OFF AUTO UPDATES FOR DEPENDENCIES.
One good thing is that this bad actor will just bring more light to better practices for dependency management.
My country has enemies that believe “supernatural forces” will reward them if they give their lives (even their infant lives) in a fight to destroy all post-Roman civilizations.
The ONLY proven way to deal with fanatics (that use suicide as a weapon) is with “shock-and-awe” (as best demonstrated against “The Empire of the Sun” in Nagasaki and Hiroshima). When infants are killed like that, it’s not “to bring democracy,” but to prevent attacks on all post-Roman civilization, democratic or not.
But such “shock-and-awe” has opposite effect on civilized people. Patrick Henry said “Give me Liberty, or give me death” and Benjamin Franklin said, “Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety.” Where Putin went wrong is he gave into a supernatural belief that because Russia is a name on an ancient empire of people and it is a name of his country in 2022, he is obligated to recreate the empire. Russian people in 2022 will have to give their lives until a bullet is in his brain, or they will be cutoff totally from the rest of the World. It is also a necessary demonstration for China and DPRK, so there will be no compromise or payment of nuclear blackmail.
If you used to like node-ipc, try hyper-ipc... its pretty cool, you can ipc behind nats without forwarding, you can move nodes without ip changes, ground-breaking.
If you got hit using vue.js, try nobuild style app making its awesome! I've been using riot.js with zero build tools for two years now, and never looked back, there is no easier way to build apps.
13 comments
[ 0.26 ms ] story [ 66.2 ms ] threadmodule in question: https://github.com/RIAEvangelist/peacenotwar
news article for news people https://securityboulevard.com/2022/03/supply-chain-attack-no...
deeper dive into the code: https://github.com/RIAEvangelist/node-ipc/issues/233
@dang plz don't remove, think I am the first to post about this
TURN OFF AUTO UPDATES FOR DEPENDENCIES. One good thing is that this bad actor will just bring more light to better practices for dependency management.
https://www.flyingpenguin.com/?p=38727
Edit: you can read his responses here https://github.com/RIAEvangelist/node-ipc/issues/233
Looks like normal advertising to me.
Seriously, stop killing Ukrainian infants https://m.youtube.com/watch?v=6YF0qfAj8IY and maybe civilized societies around the planet will stop leaving you alone.
The ONLY proven way to deal with fanatics (that use suicide as a weapon) is with “shock-and-awe” (as best demonstrated against “The Empire of the Sun” in Nagasaki and Hiroshima). When infants are killed like that, it’s not “to bring democracy,” but to prevent attacks on all post-Roman civilization, democratic or not.
But such “shock-and-awe” has opposite effect on civilized people. Patrick Henry said “Give me Liberty, or give me death” and Benjamin Franklin said, “Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety.” Where Putin went wrong is he gave into a supernatural belief that because Russia is a name on an ancient empire of people and it is a name of his country in 2022, he is obligated to recreate the empire. Russian people in 2022 will have to give their lives until a bullet is in his brain, or they will be cutoff totally from the rest of the World. It is also a necessary demonstration for China and DPRK, so there will be no compromise or payment of nuclear blackmail.
Edit: Apparently the malware isn't working: https://github.com/RIAEvangelist/node-ipc/issues/273
And then there's the licence incompatibility: https://github.com/RIAEvangelist/node-ipc/issues/260
If you got hit using vue.js, try nobuild style app making its awesome! I've been using riot.js with zero build tools for two years now, and never looked back, there is no easier way to build apps.
Don't look back! build back better!