Comments (8)
This package is flagged as problematic also by Socket, i.e. https://socket.dev/npm/package/es5-ext/issues/0.10.62
postinstall
scripts are a big red flag for security teams. Using postinstall
for political purposes, or asking for donations, or publishing news will lead to that package being slowly deprecated/banned from the communty.
from es5-ext.
@jonataswalker what exactly tool reports that to you?
Note that all package does is that it prints short message on installation, nothing harmful and that unusual (hundreds of npm packages do that)
This is known to be reported by russian owned anti-virus tools (we're discussing it at #186)
from es5-ext.
from es5-ext.
@jonataswalker is there a dedicated page for this violation where I can contact Sonatype
from es5-ext.
It looks like there's a path starting from https://ossindex.sonatype.org/component/pkg:npm/es5-ext
from es5-ext.
Isn't it (at least) a curious "call for peace"?
I have a broken pipeline, therefore an interrupted deploy. I have to prepare a justification for the security team to suppress this issue and let the work goes on.
from es5-ext.
I have a broken pipeline, therefore an interrupted deploy. I have to prepare a justification for the security team to suppress this issue and let the work goes on.
Same. This also impacts all downstream projects, and any library that ends up installing es5-ext
through indirect dependencies. For example, if I try to add cubejs
, our security rules will block the PR for reasons that I now have to investigate/explain/defend:
from es5-ext.
I'm closing this as duplicate of #186 (please funnel all discussion there).
@eugene1g as in screenshot, this package just prints a short message on installation, it's nothing to be worried about security-wise. Best if you just ignore it.
from es5-ext.
Related Issues (20)
- v0.10.54 release breaks package installation HOT 25
- The NPM package is not a place for politics HOT 7
- Reasoning for anti-war manifest HOT 609
- On manifestations :) HOT 6
- Perhaps, some improvements to wording HOT 4
- Unfortunately the protest-ware in the manifest means your package has been marked as critical HOT 2
- Postinstall broken for pnpm 7+ HOT 6
- Postinstall not fit for Windows HOT 23
- This is not malware, but... HOT 1
- package being detected as a virus HOT 54
- npm ERR! code EINTEGRITY HOT 2
- Error: ELOOP: too many symbolic links encountered HOT 2
- fu'ed postinstall message HOT 2
- Clean repo from Malware scripts HOT 1
- Move "call for peace" to `README.md` to avoid unintended consequences HOT 1
- redos in es5-ext HOT 24
- Why you don't call for peace in Gaza? HOT 1
- Failed to exec postinstall script on Linux HOT 5
- Can't install on linux HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from es5-ext.