-
-
Notifications
You must be signed in to change notification settings - Fork 6.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Jest (or Rollup) ecosystem dependency hacked? #12226
Comments
Please note this issue tracker is not a help forum. We recommend using StackOverflow or our discord channel for questions. |
Wait a second, the |
Grepping for A "liberty" release: https://www.npmjs.com/package/colors?activeTab=versions Seems to be Marak/colors.js#285 |
Not sure if it will work for your use case, but it worked for mine: |
The maintainer of colors.js seems to be probably burned out and probably did not do this by accident. |
See also https://news.ycombinator.com/item?id=25032105 which sheds some light on the past (afaik he lost most due to a fire). More of this at https://news.ycombinator.com/from?site=github.com/marak |
No reason to discuss here |
I was updating jest and rollup dependencies, and bizarre messaging began spewing in my terminal.
(EDIT: the reproduction is running only Rollup. This might be in the Rollup ecosystem. I apologize if that's the case.)
I figured someone should be aware of this because jest or rollup users may be affected. I will report this to the Rollup team as well.
I am reporting this here because I don't believe there is any threat in reporting it, as I'm not reporting an actual vulnerability.
It seems that someone's npm account may be hacked, but I don't know whose. Also I don't know if the hacked dependency is doing anything malicious other than logging strange messages to terminal.
Try these steps:
It may take several tries before anything happens, but once it does, you should see strange output like in the attached screenshot. This output appears to be from code running in a hacked sub-dependency.
If you try the same steps but with the
develop
branch, there will not be any problem.If you run
git diff develop dependency-hacked -- package.json
, you'll see a couple new packages added, plus jest and rollup updates.Screenshot of the output:
Snippet of the output (only the first part, but the noisy stuff repeats for a long time):
At the right screen width, the first part makes a picture. The noisy part seems to say "testing testing" over and over.
The text was updated successfully, but these errors were encountered: