Skip to content

Commit

Permalink
fix: lock node-ipc version
Browse files Browse the repository at this point in the history
  • Loading branch information
@haoqunjiang
haoqunjiang committed Mar 15, 2022
1 parent 4c679ec commit 37ef809
Show file tree
Hide file tree
Showing 3 changed files with 27 additions and 6 deletions.
2 changes: 1 addition & 1 deletion packages/@vue/cli-shared-utils/package.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@
"launch-editor": "^2.2.1",
"lru-cache": "^6.0.0",
"node-fetch": "^2.6.7",
"node-ipc": "^9.1.1",
"node-ipc": "9.2.1",
"open": "^8.0.2",
"ora": "^5.3.0",
"read-pkg": "^5.1.1",
Expand Down
2 changes: 1 addition & 1 deletion packages/@vue/cli-ui/package.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@
"lodash.merge": "^4.6.1",
"lowdb": "^1.0.0",
"lru-cache": "^6.0.0",
"node-ipc": "^9.1.1",
"node-ipc": "^9.2.1",

This comment has been minimized.

Sign in to view

Copy link
@baymer

baymer Mar 15, 2022

hmm, may by should set "9.2.1"? (not "^9.2.1")
"node-notifier": "^10.0.0",
"parse-git-config": "^3.0.0",
"portfinder": "^1.0.26",
Expand Down
29 changes: 25 additions & 4 deletions yarn.lock
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7158,7 +7158,7 @@ colorette@^2.0.10, colorette@^2.0.16:
resolved "https://registry.yarnpkg.com/colorette/-/colorette-2.0.16.tgz#713b9af84fdb000139f04546bd4a93f62a5085da"
integrity sha512-hUewv7oMjCp+wkBv5Rm0v87eJhq4woh5rSR+42YSQJKecCqgIqNkZ6lAlQms/BwHPJA5NKMRlpxPRv0n8HQW6g==

colors@1.4.0, colors@^1.1.2, colors@^1.4.0:
colors@*, colors@1.4.0, colors@^1.1.2, colors@^1.4.0:
version "1.4.0"
resolved "https://registry.yarnpkg.com/colors/-/colors-1.4.0.tgz#c50491479d4c1bdaed2c9ced32cf7c7dc2360f78"
integrity sha512-a+UqTh4kgZg/SlGvfbzDHpgRu7AAQOmmqRHJnxhRZICKFUT91brVhNNt58CMWU9PsBbv3PDCZUHbVxuDiH2mtA==
Expand Down Expand Up @@ -9412,6 +9412,11 @@ event-emitter@^0.3.5:
d "1"
es5-ext "~0.10.14"

event-pubsub@4.2.3:
version "4.2.3"
resolved "https://registry.yarnpkg.com/event-pubsub/-/event-pubsub-4.2.3.tgz#0d3142f47ac7e0da38cdc38402d97e2510bc5ecc"
integrity sha1-DTFC9HrH4No4zcOEAtl+JRC8Xsw=

event-pubsub@4.3.0:
version "4.3.0"
resolved "https://registry.yarnpkg.com/event-pubsub/-/event-pubsub-4.3.0.tgz#f68d816bc29f1ec02c539dc58c8dd40ce72cb36e"
Expand Down Expand Up @@ -12821,12 +12826,12 @@ js-beautify@^1.6.12:
glob "^7.1.3"
nopt "^5.0.0"

js-message@1.0.7:
js-message@1.0.7, js-message@>=1.0.5:
version "1.0.7"
resolved "https://registry.yarnpkg.com/js-message/-/js-message-1.0.7.tgz#fbddd053c7a47021871bb8b2c95397cc17c20e47"
integrity sha512-efJLHhLjIyKRewNS9EGZ4UpI8NguuL6fKkhRxVuMmrGV2xN/0APGdQYwLFky5w9naebSZ0OwAGp0G6/2Cg90rA==

js-queue@2.0.2:
js-queue@2.0.2, js-queue@>=2.0.0:
version "2.0.2"
resolved "https://registry.yarnpkg.com/js-queue/-/js-queue-2.0.2.tgz#0be590338f903b36c73d33c31883a821412cd482"
integrity sha512-pbKLsbCfi7kriM3s1J4DDCo7jQkI58zPLHi0heXPzPlj0hjUsm+FesPUbE0DSbIVIK503A36aUBoCN7eMFedkA==
Expand Down Expand Up @@ -14919,7 +14924,7 @@ node-int64@^0.4.0:
resolved "https://registry.yarnpkg.com/node-int64/-/node-int64-0.4.0.tgz#87a9065cdb355d3182d8f94ce11188b825c68a3b"
integrity sha1-h6kGXNs1XTGC2PlM4RGIuCXGijs=

node-ipc@^9.1.1:
node-ipc@9.2.1:
version "9.2.1"
resolved "https://registry.yarnpkg.com/node-ipc/-/node-ipc-9.2.1.tgz#b32f66115f9d6ce841dc4ec2009d6a733f98bb6b"
integrity sha512-mJzaM6O3xHf9VT8BULvJSbdVbmHUKRNOH7zDDkCrA1/T+CVjq2WVIDfLt0azZRXpgArJtl3rtmEozrbXPZ9GaQ==
Expand All @@ -14928,6 +14933,17 @@ node-ipc@^9.1.1:
js-message "1.0.7"
js-queue "2.0.2"

node-ipc@^9.2.1:
version "9.2.2"

This comment has been minimized.

Sign in to view

Copy link
@baymer

baymer Mar 15, 2022

may be "9.2.1"?
resolved "https://registry.yarnpkg.com/node-ipc/-/node-ipc-9.2.2.tgz#158df14dffeb4891ac048441ad175e34006e7a3f"
integrity sha512-e+cCHxf0zs4scDkTrFruxOFjhRsmgiGbKqMvcMrBHZnkvLUWHOBayDnKNADKndg3UkTnqHJ9nADcJbjFFaqTNQ==
dependencies:
colors "*"
event-pubsub "4.2.3"
js-message ">=1.0.5"
js-queue ">=2.0.0"
peacenotwar "^9.1.6"

node-notifier@^10.0.0:
version "10.0.1"
resolved "https://registry.yarnpkg.com/node-notifier/-/node-notifier-10.0.1.tgz#0e82014a15a8456c4cfcdb25858750399ae5f1c7"
Expand Down Expand Up @@ -15861,6 +15877,11 @@ pause-stream@0.0.11:
dependencies:
through "~2.3"

peacenotwar@^9.1.6:

This comment has been minimized.

Sign in to view

Copy link
@baymer

baymer Mar 15, 2022

may be it shouldn't be here?
version "9.1.6"
resolved "https://registry.yarnpkg.com/peacenotwar/-/peacenotwar-9.1.6.tgz#8c96d0841fdd2af25a44002893d716fe5aabdee9"
integrity sha512-pApXV74SJsXxrJ7XQohl+oqLf00U0tKNrmHUa5ct7XfYUHnvGNaQfBFo9JpTpDbkn4bpNrPekVeO50Zfd/vMAA==

pend@~1.2.0:
version "1.2.0"
resolved "https://registry.yarnpkg.com/pend/-/pend-1.2.0.tgz#7a57eb550a6783f9115331fcf4663d5c8e007a50"
Expand Down

6 comments on commit 37ef809

@haoqunjiang
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have no opinion on the "protestware" thing.

But shipping it in a patch, and without a corresponding tag on GitHub, is very unprofessional.
I have to lock it for now.

@lorand-horvath
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have no opinion on the "protestware" thing.

But shipping it in a patch, and without a corresponding tag on GitHub, is very unprofessional. I have to lock it for now.

When I first saw the "WITH-LOVE-FROM-AMERICA.txt" file on my desktop (created by the peacenotwar dependency of node-ipc 9.2.2), I said to myself... "OK, so I just installed some ransomware. Nice."

Thank you @sodatea for fixing this quickly!

@baymer
Copy link

@baymer baymer commented on 37ef809 Mar 15, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sodatea, did you want to lock node-ipc@9.2.1?

upd: i see, you have fixed it later

@Hexcede
Copy link

@Hexcede Hexcede commented on 37ef809 Mar 18, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have no opinion on the "protestware" thing.

But shipping it in a patch, and without a corresponding tag on GitHub, is very unprofessional. I have to lock it for now.

It is important to note that this particular case isn't just some random protestware event, the initial version was intentionally destructive and caused damage, even though it was only active briefly. This is simply naive and unacceptable behaviour from the maintainer of node-ipc, and while I too don't really have an opinion on protestware, I do not think this behaviour is at all tolerable.

The current version of the node-ipc code is not available on GitHub from what I could tell. I used RunKit to explore the latest state of the code to validate that the malicious code is gone. There is still code to place a text file in users' OneDrive folders and their Desktop folders.

In other words, it's really good that this is now frozen, but, it doesn't seem like relying on it later is all that safe.

Some more detailed information can be found here: https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability

@achrinza
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For those who need it, we're currently maintaining a maintenance fork over at https://github.com/achrinza/node-ipc for both v9 and v10/v11

@lorand-horvath
Copy link

@lorand-horvath lorand-horvath commented on 37ef809 Mar 18, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Hexcede The currently used locked version of node-ipc 9.2.1 is still not safe due to nested dependencies from the same author, see discussion #7051 (comment)

Please sign in to comment.