You’re right and the excerpt you quoted was poorly worded and confusing. A lockfile is designed to do exactly what you said.
The package.json locked the file to ^1.3.2. If a newer version exists online that still satisfies the range in package.json (like 1.3.3 for ^1.3.2), npm install will often fetch that newer version and update your package-lock.json file automatically.
That’s how I understand it / that’s my current knowledge. Maybe there is someone here who can confirm/deny that. That would be great!
Noticed that after ten mins, contacted author immediatly and he seems to be working on it / restoring his account / removing malware on published packages.
One of the most insidious parts of this malware's payload, which isn't getting enough attention, is how it chooses the replacement wallet address. It doesn't just pick one at random from its list.
It actually calculates the Levenshtein distance between the legitimate address and every address in its own list. It then selects the attacker's address that is visually most similar to the original one.
This is a brilliant piece of social engineering baked right into the code. It's designed to specifically defeat the common security habit of only checking the first and last few characters of an address before confirming a transaction.
It looks like a lot of packages of the author have been compromised (in total over 1 billion downloads). I've updated the title an added information to the blog post.
The discrepancy comes from how npm packages are published. What you see on GitHub is whatever the maintainer pushed to the repo, but what actually gets published to the npm registry doesn’t have to match the GitHub source. A maintainer (or someone with access) can publish a tarball that includes additional or modified files, even if those changes never appear in the GitHub repo. That’s why the obfuscated code shows up when inspecting the package on npmjs.com.
As for the “0 downloads” count: npm’s stats are not real-time. There’s usually a delay before download numbers update, and in some cases the beta UI shows incomplete data. Our pipeline picked up the malicious version because npm install resolved to it based on semver rules, even before the download stats reflected it. Running the build locally reproduced the same issue, which is how we detected it without necessarily incrementing the public counter immediately.
Hey, I just found your LinkedIn Profile and noticed that we studied at the same university - even the same degree! I've send you a request on LinkedIn, so maybe we could connect and have a chat?
Thanks for sharing this with us. This advice (change from being a shooting star to helping others to improve) seems to be in contrast to the article. Or am I missing something?
Thank god for this article. I'm a new tech lead with 1 person in my team. This person is even from a different country, new to the industry and not that advanced in his programming skills. I noticed everything this article describes.
Although everything gets better day by day, week by week, it is still difficult and I sometimes even have the feeling "damn, do I really want to be a tech lead?"
Hey, are there already some tutorials / books for Phoenix 1.3? I found this [1], but it will be released in late december 2017. Any ideas / recommendations for the Phoenix 1.3? Folder structure and models (schemas) got changed quite a bit.
Profession: Student + Software dude
I'm constantly switching between working and learing from my coworkers & going to university.
Work-day (3 months in a row):
[06:45] Wake up, shower & get ready for work, drinking a cup of coffee
[07:45] Out the door, 30 min to office (by car)
[08:15] Arrive at work, checking mails & start getting up2date
[09:00] Starting to seriously developing stuff and things
[13:00] Lunch! Yes!
[13:30] Back to work! Now is the time where some coworkes come to me and to ask some stuff about stuff I did
[17:00] Officially finished the day
[17:15] Getting out of the office & driving home
Student-day (3 months in a row)
[07:00] Wake up and get ready for university + drinking some coffee
[08:15] First lesson starts
[13:00] Lunch :)
[13:30 - 14:00] Lunch ends & next lesson starts
[16:45 - 17:30] Getting home
[18:30] Dinner-time!
[19:00 - 23:30 (or later)] Re-read university stuff, studying, ...
University-Phase is way more stressfull, because we have to finish a semester in 10-12 weeks, instead of 6 months. But I just don't want to miss the work-phase, I love it! Learning so much stuff each day while being a "regular" team member :)