Skip to content

fix: node-ipc#181

Merged
gemwuu merged 1 commit intomasterfrom
atian25-patch-1
Mar 15, 2022
Merged

fix: node-ipc#181
gemwuu merged 1 commit intomasterfrom
atian25-patch-1

Conversation

@atian25
Copy link
Copy Markdown
Contributor

@atian25 atian25 commented Mar 15, 2022

@gemwuu
Copy link
Copy Markdown
Member

gemwuu commented Mar 15, 2022

LGTM

@gemwuu gemwuu merged commit bfeb95f into master Mar 15, 2022
@gemwuu gemwuu deleted the atian25-patch-1 branch March 15, 2022 13:40
@atian25

This comment was marked as off-topic.

@github-actions
Copy link
Copy Markdown

🎉 This PR is included in version 1.70.6 🎉

The release is available on:

Your semantic-release bot 📦🚀

@hax
Copy link
Copy Markdown

hax commented Mar 15, 2022

有鉴于此模块的有意行为(包括更恶劣的根据IP覆盖文件),光针对特定版本可能还不够,可能需要暂时直接锁定后续所有版本。

@fengmk2
Copy link
Copy Markdown
Member

fengmk2 commented Mar 16, 2022

有鉴于此模块的有意行为(包括更恶劣的根据IP覆盖文件),光针对特定版本可能还不够,可能需要暂时直接锁定后续所有版本。

我会先锁定 node-ipc 的更新同步

@atian25
Copy link
Copy Markdown
Contributor Author

atian25 commented Mar 16, 2022

@fengmk2 是不是顺便把这 3 个版本先手动删掉?避免用 npm/yarn/pnpm 连 npmmirrror 的用户受到影响。

新版 cnpm registry 好像没有迁移这个:cnpm/cnpmcore#184

@hax
Copy link
Copy Markdown

hax commented Mar 16, 2022

Copy from vuejs/vue-cli#7054 (comment)

The behavior — committed malicious code, deleted comments which expose such code, revoked the api key after been exposed and promoted the sophistry that the code not work because api key is not valid — make me think the guy is not worth trust anymore. I strongly suggest npmmirror not only blacklist node-ipc but all his packages.

@atian25
Copy link
Copy Markdown
Contributor Author

atian25 commented Mar 16, 2022

https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/

@SekiBetu
Copy link
Copy Markdown

好吓人啊

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants