7 ms·

I do not envy the position the npm team are in. They removed the ability to unpublish packages as a response to the left-pad incident[1] because it wasn't desir

I do not envy the position the npm team are in. They removed the ability to unpublish packages as a response to the left-pad incident[1] because it wasn't desirable for individual developers to break downstream dependencies by pulling their package maliciously. Of course the side effect is that now it's much harder to pull packages for legitimate reasons :/ [1] https://en.wikipedia.org/wiki/Npm_left-pad_incident https://en.wikipedia.org/wiki/Npm_left-pad_incident

antihero 4mo ago
I would prefer my builds to break than the ecosystem to be compromised. That said, once unpublished the version should be permanently unavailable to prevent publishing over known good versions.
deleted 4mo ago
[deleted]
ummonk 4mo ago
I mean they brought that incident on themselves...
- shimman 4mo ago
  Yeah, all left pad incident showed was that NPM cares more about their corporate users than open source developers.
zarzavat 4mo ago
The obvious solution is that unpublish should be available within a time window after a new version is published and then unavailable after that.
- beart 4mo ago
  There is a time window - https://docs.npmjs.com/policies/unpublish https://docs.npmjs.com/policies/unpublish
  - zarzavat 4mo ago
    Yes but they didn't do it properly. They only allow unpublishing if there are no dependants, which means it can't be used to pull a package version for security reasons. It should be that within the first X hours you can pull a version regardless of dependants, after that you should need approval.
superfrank 4mo ago
Maybe give publishers a way to quarantine versions with a warning that stops the install, but allows users can override if they choose to is the next step? Give a publisher a way to tag a version as malicious and then in those hours between the exploit being noticed and the package being removed anyone who tries to install gets a message about that version being quarantined and asking whether they want to proceed. It's not a perfect solution, but I think it's better than just waiting for NPM to take action without opening the door up to another left pad situation.
thayne 4mo ago
I think cargo's yank is a good balance. It makes it difficult to pull the yanked version in as a dependency, but doesn't break existing usages, as long as the version is in the lockfile. And I think even then gives you a warning that you are using a yanked package.
KajMagnus 4mo ago
If a package developer maliciously breaks everyone's builds, isn't that pretty great? Because now you have learnt that you can't trust them

antihero 4mo ago

I would prefer my builds to break than the ecosystem to be compromised. That said, once unpublished the version should be permanently unavailable to prevent publishing over known good versions.

deleted 4mo ago

[deleted]

ummonk 4mo ago

I mean they brought that incident on themselves...

shimman 4mo ago
Yeah, all left pad incident showed was that NPM cares more about their corporate users than open source developers.

zarzavat 4mo ago

The obvious solution is that unpublish should be available within a time window after a new version is published and then unavailable after that.

beart 4mo ago
There is a time window - https://docs.npmjs.com/policies/unpublish https://docs.npmjs.com/policies/unpublish
- zarzavat 4mo ago
  Yes but they didn't do it properly. They only allow unpublishing if there are no dependants, which means it can't be used to pull a package version for security reasons. It should be that within the first X hours you can pull a version regardless of dependants, after that you should need approval.

superfrank 4mo ago

Maybe give publishers a way to quarantine versions with a warning that stops the install, but allows users can override if they choose to is the next step? Give a publisher a way to tag a version as malicious and then in those hours between the exploit being noticed and the package being removed anyone who tries to install gets a message about that version being quarantined and asking whether they want to proceed. It's not a perfect solution, but I think it's better than just waiting for NPM to take action without opening the door up to another left pad situation.

thayne 4mo ago

I think cargo's yank is a good balance. It makes it difficult to pull the yanked version in as a dependency, but doesn't break existing usages, as long as the version is in the lockfile. And I think even then gives you a warning that you are using a yanked package.

KajMagnus 4mo ago

If a package developer maliciously breaks everyone's builds, isn't that pretty great? Because now you have learnt that you can't trust them