<beneroth>
"he emailed me and said he wanted to maintain the module, so I gave it to him. I don't get any thing from maintaining this module, and I don't even use it anymore, and havn't for years."
<beneroth>
maintainer gives ownership to new guy, new guy injects malware :)
<beneroth>
"part in the original report where it stated that the malicious code was only present in the minified version of the package? Seems there is an underlying issue of npm not enforcing deterministic minification or something along those lines here."
<beneroth>
so... despite the social-political dimension of problems like this... I would blame NPM for that :)
<aw->
wow
<beneroth>
maybe interesting for tankf33der too, the injected malware is apparently modifying the behaviour when used in combination with crypto code
<xkapastel>
woww
<xkapastel>
another attack like this?
<xkapastel>
is npm even safe to use
<xkapastel>
i guess it really isn't. they need to rethink the model
<beneroth>
npm is not safe to use!
<beneroth>
that was obvious years ago.
<beneroth>
NPM itself (the company, the repo) had 2 (or was it 3?) incidents which allowed undetected placing of malware (without having to social-engineer the original owner to hand over ownership/maintainer-rights)
<beneroth>
they promised to fix their process and add controls after each case, which they obviously didn't do
<beneroth>
this case is a bit more special, as the maintainer/owner-rights got handed to a bad actor - but still, that the guy managed to put the malware only in the minified version of the code (while the non-minified-code looks good) I would see as failure of NPM.
<beneroth>
obviously the minified version is usually used in production code, and the non-minified version for development and debugging.