Hacker News Reader

Comment by hn_throwaway_99 | Hacker News Reader

I think the blog author is implying as much as he can, without directly accusing, that he believes that https://github.com/shinnn was responsible for the bad code, not a random hack.

View on HN

To quote the article: "As far as we are aware, the only purpose of the malicious code was to sabotage the purescript npm installer to prevent it from running successfully... the purpose of this condition [in the code, hardcoded to include the word 'cli'] seems to be to ensure that the malicious code only runs when our installer is being used (and not @shinnn’s)."

:hmm:

>>[[ 9 July, around 0100 UTC: @doolse identifies thatload-from-cwd-or-npm@3.0.2 is the cause. See purescript/npm-installer#12 (comment) @doolse opens an issue on the load-from-cwd-or-npm repo pointing out that the package is breaking the purescript npm installer (although at this stage, none of us spot that the code is malicious). This issue is later deleted by @shinnn. ]]

Hmm indeed. A hack is possible but the timeline of events is dubious.

2FA would also make it much harder to use the "somebody hacked me" defense.

No at that point they'd be saying "zomg NPM has a terrible bug that allowed the hacker to bypass my 2FA!"

If someone is trying to redirect blame they'll always find some way to do so.

The problem is not liars, the problem is being unable to prove they were lying. With 2FA, the logs would prove it.

Unfortunately, based on preexisting cases it really doesn't make much of a difference, the liars will still deflect the blame and the logs will always be "wrong".

Reply on news.ycombinator.com