npm Blog

Yes, it can break deps, some will not install. Puppeteer is a good example because it installs binaries. But it also shows an error with the cmd needed to complete the installation. Why it is allowed by default? > it’s npm’s belief that the utility of having installation scripts is greater than the risk of worms. NPM co-founder Laurie Voss https://blog.npmjs.org/post/141702881055/package-install-scripts-vulne…

I'm surprised there's not a single mention of "Microsoft" in this or the npm announcement [1], given the old-evil-history of Microsoft and the new-nice Microsoft we have today. I would expect that there was at least a mention, considering the reason that most modules in npm are still in ES5 is exactly because of the monopolistic practices that Microsoft followed back in the day which makes Internet Explorer still relevant. Not negative, not positive comment. Just surprising there was no mention. And I do think Microsoft is doing a great job recently with Open Source in general. [1] https://blog.npmjs.org/post/612764866888007680/next-phase-montage

Here is the official response from npm: http://blog.npmjs.org/post/169432444640/npm-operational-incident-6-jan… TL;DR: "no malicious actors were involved in yesterday’s incident, and the security of npm users’ accounts and the integrity of these 106 packages were never jeopardized." A more detailed report will follow in the next days.

worth mentioning, since this article npm has released two-factor authentication \o/ http://blog.npmjs.org/post/166039777883/protect-your-npm-account-with-… make sure you turn it on.

Yes I think you are right when NPM first introduced it, which was in NPM 5 [1]. At that time package locks were new. Node 16 shipped with NPM 8, and by then this was not the behavior any more. I don't remember exactly when, but I believe it might've been in NPM 7 when this changed. Node 15 would have been the first release to ship with at least NPM 7 [2] EDIT: Node 16.0.0 shipped with NPM 7.8.0 https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V16.… EDIT 2: A StackOverflow confirming NPM 5 behaved the way you remember: https://stackoverflow.com/questions/45022048/why-does-npm-install-rewr… EDIT 3: And, as that SO documents, 5.4.2 changed the behavior to prevent this, here's the GitHub issue: https://github.com/npm/npm/issues/17979#issuecomment-332701215 Honestly no guarantees it worked as intended right at that release, but the intention is clear. EDIT 4: I realize that the following may present retort but it matches my mental model perfectly: > If you manually edit your package.json to have different ranges and run npm i and those ranges aren't compatible with your package-lock.json then the latter will be updated with version that are compatible with your package.json. Further runs of npm i will be as with 2 above. This is what I've mentioned elsewhere: You should not update package.json's versions and deploy it and expect that versions won't change when NPM install runs. In fact, npm ci will just fail in this situation,…

NPM added namespaces in version 2, which was released in Sep 2014, just 2 months before cargo was announced. I don't remember anyone making a big deal about using scopes in NPM for several years after that, it was just there as an option. The announcement blog post of v2 only gives two paragraphs to scoped packages and explicitly frames the feature as being for enterprises and private modules [0]: > The most prominent feature driving the release of npm 2 didn’t actually need to be in a new major version at all: scoped packages. npm Enterprise is built around them, and they’ll also play a major role when private modules come to the public npm registry. My memory is that the industry as a whole didn't really start paying attention to the risks posed by dependencies in package managers until the left pad incident. To be clear, I'm not saying that it was a good idea to not have a better namespace system or that they were completely ignorant of better options, just that they were very much following the norms at the time. [0] https://blog.npmjs.org/post/98131109725/npm-2-0-0.html

Here's what isaacs writes in the NPM blog post (https://blog.npmjs.org/post/612764866888007680/next-phase-montage). It doesn't seem like anyone on the NPM team did great financially from this: "I have a set of goals that I wrote down back then, and have shared openly with the team. ... 3. Get a big enough exit that I can quit my job and see what comes out of me a second time. 4. Share the rewards equitably with the people who got npm to where it is. ... On (3), well, I’m still working a jobby job, but I always knew that was a long shot, and “make npm a better package manager” is a job I enjoy. And as for (4), I’m proud of the deals that we’ve been able to negotiate for the team. It’s not a kajillion billion dollar 10x startup cinderella story, and we’ve taken our hits, but in the end we’ve done right by our community, team, and careers, and I’m extremely proud of what we’ve achieved."

I did a quick browse through the threads in question and suggest others do the same. Yes, there is negativity, but the actual debate is more complex than simply one grumpy side slamming a poor developer. The most relevant comment I found was by /u/bixmix: > It's getting much worse - not better. The internal churn within pip also is not community driven as much as it is developer driven. It's like we didn't learn from the debacle of python3 vs 2. I'm not a Pythonist so I had no idea there was such a huge debate over how to manage deps. At various points the past few years I've googled "bundler for python" and come up with different projects. I remember trying pipenv early on (didn't work with conda Python install). Then I revisited it months later--the project was much more developed--and it worked great. FWIW I like pipenv, it solves my largest gripe with Python development. If you have as part of your community philosophy "there should be one—and preferably only one—obvious way to do it," it seems like you're going get a lot of stubborn tug-of-war situations (see 2 vs 3) where each side thinks their way is the superior way and there is less room to compromise for the sake of keeping the community together. That said, this pattern of debate is pretty universal across communities. Ruby--even with it's MINASWAN motto--had it's own RVM vs rebenv drama back in 2011. Same sort of developer/community vs developer/community drama. Nowadays I think rbenv has a larger…

There's two distinct problems I see here, which probably plague most package managers: 1. Package naming: All the good names will be gone soon, which'll probably lead to big players trying to get package names of little players. Which will then result in broken dependencies a la left-pad. Afaik the latter has been solved in NPM [1]. The former is probably more of a usability problem, we want installation to be simple and able to install deps just by remembering their name. 2. The power of deps and our reliance on good will: When installing dependencies, we basically grant them the power to wreak any kind of havoc they want. The ways we mitigate the worst: Belief in the magical power of open source, mostly using libs that are popular (hence might've gotten a good read by an IT-sec person) and at enterprise scale some static analysis tools to get an idea of how it interacts with your system. I think we're in need of a technical solution at the package manager level, where a dependency has to explicitly ask for certain capabilities (similar to how Android apps work). [1] http://blog.npmjs.org/post/141905368000/changes-to-npms-unpublish-poli…

This vulnerability was reported to NPM in 2016: https://blog.npmjs.org/post/141702881055/package-install-scripts-vulne… https://www.kb.cert.org/vuls/id/319816 but the NPM response was WAI.

Sure, the need for backpressure occurs anyway, regardless of batching optimization. Couldn't find any specific rate limit numbers besides the one mentioned here[0] from 2019: > Up to five million requests to the registry per month are considered acceptable at this time [0]: https://blog.npmjs.org/post/187698412060/acceptible-use.html

npm download numbers are always exceptionally inflated. I'm sure that number serves some purpose, but I've never found them to be a useful metric when I've worked on public packages. An ancient post [1] for the defunct npm blog offers some details: > So the count of “downloads” is much larger than the number of people who typed “npm install yourpackage” on any given day. I'm sure the particulars have changed over time, but directionally, npm download numbers aren't a proxy for "# of developers using my package". [1]: https://blog.npmjs.org/post/92574016600/numeric-precision-matters-how-…

> NPM wants to have its cake and eat it too, which is the problem here. The solution is just to say that if you publish a package to NPM you give it the perpetual right to distribute it as-is, and then remove the ability for users to delete their packages at-will. Yes, exactly! Kind of unrelated, but I think it is important to remember that the left-pad was also ENTIRELY npm team's fault. You can't just take away a namespace from someone just because some startup like kik comes knocking. Toyota does not have a right to my domain dot tld slash toyota The correct answer would have been npm to tell kik to pound sand. npm has never fixed this grave error. https://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm > We stand by our package name dispute resolution policy, and the decision to which it led us. npm deserves to die.

With Wasm + WASI, you need to explicitly mount files and environment variables. Inside the Wasm VM, the Python interpreter, source code and dependencies only have access to a very reduced surface. Although you're right that if you mount credentials inside, they will be accessible too. The incident I was talking about was the event-stream[1] vulnerability. The attacker introduced code that looked for the data of a crypto wallet. This data was stored in the user's home. By default, interpreters may get access to the same resources that the user running the process. In Wasm, the resources are granted manually. [1] https://blog.npmjs.org/post/180565383195/details-about-the-event-strea…

I mean, catering to the needs of the many rather than the few has pretty much been npm policy since left-pad-gate: https://twitter.com/seldo/status/712417019686100992 https://blog.npmjs.org/post/141905368000/changes-to-npms-unpublish-pol…

NPM has been tightening up its publish and unpublish rules for over half a decade. https://thenewstack.io/the-kik-kerfuffle/ That GitHub is now the owner of NPM doesn't change that policy and maturing of the environment. https://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm > We dropped the ball in not protecting you from a disruption caused by unrestricted unpublishing. We’re addressing this with technical and policy changes.

This gives yet another example of why "ignore scripts"[0] should be the default setting for npm install. Actually it's a pity that the npm Security Insights API[1] seems to have been abandoned since the company was bought by Microsoft. It seems like it could have highlighted the addition of a suspicious install script, although how useful it would be in practice would depend on the UX of the tooling that uses it. [0] https://www.nerdycode.com/prevent-npm-executing-scripts-security/ [1] https://blog.npmjs.org/post/189189888357/npm-security-insights-api-pre…

One can protect from these kinds of vulnerabilities by setting ignore-scripts to true as default: npm config set ignore-scripts true yarn config set ignore-scripts true https://blog.npmjs.org/post/141702881055/package-install-scripts-vulne…

From https://blog.npmjs.org/post/621733939456933888/npm-v7-series-why-keep-… > The package-lock.json file is not only useful for ensuring deterministically reproducible builds. We also lean on it to track and store package metadata, saving considerably on package.json reads and requests to the registry. Since the yarn.lock file is so limited, it doesn’t have the metadata that we need to load on a regular basis. So I guess there are some performance benefits with npm 7 compared to Yarn 1?

There's also a post on the npm blog, though that doesn't focus on the changes compared to v6: https://blog.npmjs.org/post/631877012766785536/release-v700

If you're looking for more information, see here: https://blog.npmjs.org/post/617484925547986944/npm-v7-series-introduct…

On (2) low impact: A few npm advisories mention packages that were uploading SSH keys and bashrc files. - https://www.npmjs.com/advisories/541 (package==coffeescript) - https://www.npmjs.com/advisories/765 (package==portionfatty12) There's also been packages that would upload the environment variables (increases impact significantly if this reaches production): - https://blog.npmjs.org/post/163723642530/crossenv-malware-on-the-npm-r… (package==crossenv) - https://www.npmjs.com/advisories/486 (package==sqlserver)

I am really curious as to what happens here, remember left-pad controversy? [1][2] This is like round 2. How will npm/github act now? Especially now that it's Microsoft's npm /s [1] https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/ [2] https://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm

Perhaps because Node code bases when deployed cause the package manager (npm) to consume more bandwidth in general than comparable Ruby or Python code bases due to higher dependence on third-party packages? As at Oct. 2018, the top 12 npm packages [1] were already doing more than 0.5 billion downloads a month. Granted, popularity has waned for a few of those top packages due to deprecation or new language features, for instance. EDIT: NPM’s announcement about the acquisition [2] provides up-to-date numbers: “Today, npm serves over 1.3 million packages to roughly 12 million developers, who download these things 75 billion times a month ...” 1: https://news.ycombinator.com/item?id=18343604 2: http://blog.npmjs.org/post/612764866888007680/next-phase-montage

NPM's blog post: https://blog.npmjs.org/post/612764866888007680/next-phase-montage

> I'll be glad if npm/yarn notifies me in the future. Will they actually warn the user if this happens? The npm blog post was unclear on this point: https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-…

npm must return the kik project to Azer now! https://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm

At least they brought attention to how bad it was to rely on NPM. If anyone doesn't remember, this is how the whole left-pad issue started: https://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm

And he has only been CEO for eight months (January 2019). https://blog.npmjs.org/post/181872197694/npm-inc-has-a-new-ceo-bryan-b…

This doesn’t count? https://blog.npmjs.org/post/172999548390/new-pgp-machinery