NPM... we all knew this would happen eventually

Mark — Tue, 27 Nov 2018 14:23:26 +0000

I remember reading this article when it first came you in Medium

Some highlights from the article

The following is a true story. Or maybe it’s just based on a true story. Perhaps it’s not true at all.

Although this is all made up, it worries me that none of this is hard.

There’s no shortage of smart, nasty people out there, and 580,000 npm packages. It seems to me that the odds are better than even that at least one of those packages has some malicious code in it, and that if it’s done well, you would never even know.

It's dated to Jan 6 2018, nine months later we have this
I don't know what to say.

This all reminds me of Murphy's Law.

I know there is already a post discussing about how to improve security, but what worries me the most is how toxic the Github thread became. Quoting them here would get me banned.

I know this is a very very serious issue, but let's say your new to open-source or coding in general and you finally manage to make a project that is useful to the community.

One day you open your repository to find ~500 comments, people shouting at how you screwed up big time and you don't know why. That isn't the best community experience.

I've always thought the MIT license mentioned that this can happen

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND

I personally was using Electron before from tux0r from this community pointed out this

This makes XSS particularly dangerous, as an attacker's payload can allow do some nasty things such as require in the child_process module and execute system commands on the client-side

Link to the actual comment, a small shout out thanks

Big shots do screw up

What pops to my mind is this from Donald Knuth

Err
and err
and err again
but less
and less
and less

DEV Community: Mark

NPM... we all knew this would happen eventually