Corrupted NPM libs - Faker and Colors - the dark side of Open Source

In this video you will learn the background story, and what's more important, how to protect your applications from being injected with corrupted libraries!

#quadmeup #npm #opensource

0:00 Intro
0:16 What exactly happened to faker and colors NPM libs
2:23 Did the developer have a right to do it?
2:50 What MIT license says about that
4:12 How to protect your application
5:42 Outro

[threebadmicefpv]

I guess the industry will wring its hands together for a while ... then blame the developer... then carry on freeloading 🤦

[typxxilps]

Thanks for the background and explanations.
I had only heard it on the floor in a hurrry and did not get behind it, except that someone had intentionally broken the latest version which causes a kind of confusion and how to protect the systems. But I had not time so I missed a lot I guess.

[ChemistTea]

I think it's cool that he did this. I like this guy for it. Also, I haven't used these libraries so it did not affect me.

[raviverma]

open source software has got license and most license contains clause of "absolute no warranty" and "no liablity"

[johanrg]

It's a good idea to pin packages to specific versions for a multitude of reasons, but if you think most teams actually verify that a package doesn't have "unwanted side effects" you're kidding yourself. Just download and use, screw the consequences, is my experience working with different teams unfortunately.

[breakflight]

Legal: Probably. Ethical: No. If he expected compensation, he could have chosen another license. It's not fair to say something is free and then feel bad when someone uses it for free. He lost a lot of trust when doing what he did. As a developer, he needs people to trust him.

[Server]

Same for windows updates, just turn them off. ;)

[xA]

The deliberate actions of the maintainer should be criminally charged and prosecuted. The license terms are not protective cover for malicious behaviour.