Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: node-ipc #181

Merged
merged 1 commit into from
Mar 15, 2022
Merged

fix: node-ipc #181

merged 1 commit into from
Mar 15, 2022

Conversation

atian25
Copy link
Contributor

@atian25 atian25 commented Mar 15, 2022

@gemwuu
Copy link
Member

gemwuu commented Mar 15, 2022

LGTM

@gemwuu gemwuu merged commit bfeb95f into master Mar 15, 2022
@gemwuu gemwuu deleted the atian25-patch-1 branch March 15, 2022 13:40
@atian25

This comment was marked as off-topic.

@github-actions
Copy link

🎉 This PR is included in version 1.70.6 🎉

The release is available on:

Your semantic-release bot 📦🚀

@hax
Copy link

hax commented Mar 15, 2022

有鉴于此模块的有意行为(包括更恶劣的根据IP覆盖文件),光针对特定版本可能还不够,可能需要暂时直接锁定后续所有版本。

@fengmk2
Copy link
Member

fengmk2 commented Mar 16, 2022

有鉴于此模块的有意行为(包括更恶劣的根据IP覆盖文件),光针对特定版本可能还不够,可能需要暂时直接锁定后续所有版本。

我会先锁定 node-ipc 的更新同步

@atian25
Copy link
Contributor Author

atian25 commented Mar 16, 2022

@fengmk2 是不是顺便把这 3 个版本先手动删掉?避免用 npm/yarn/pnpm 连 npmmirrror 的用户受到影响。

新版 cnpm registry 好像没有迁移这个:cnpm/cnpmcore#184

@hax
Copy link

hax commented Mar 16, 2022

Copy from vuejs/vue-cli#7054 (comment)

The behavior — committed malicious code, deleted comments which expose such code, revoked the api key after been exposed and promoted the sophistry that the code not work because api key is not valid — make me think the guy is not worth trust anymore. I strongly suggest npmmirror not only blacklist node-ipc but all his packages.

@atian25
Copy link
Contributor Author

atian25 commented Mar 16, 2022

https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/

@SekiBetu
Copy link

好吓人啊

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants