Hacker News new | past | comments | ask | show | jobs | submit login
NPM package deletes all files when detects Russian IP (github.com/vuejs)
22 points by nopurpose on March 16, 2022 | hide | past | favorite | 9 comments



Friendly reminder that the author and main contributor of the most popular JS polyfill library - core-js - is Russian:

https://github.com/zloirock

Last time he became available (doing time in a penal colony) a fairly large crisis ensued.


> Last time he became available (doing time in a penal colony) a fairly large crisis ensued.

FYI: It was nothing political, he got 18 months for running over two people on his motorbike and killing one.


I know - I followed this closely because he gained notoriety via his npm messages asking for sponsorship/job - the accident happened later. IIRC he was let go after serving a year.

In any case I imagine a wholesale IP ban on Github might result in a similar crisis.


As if people weren't critical enough of NPM and JS packages in the first place. Doesn't really speak for vue.js.


Seems like a recipe for f-up and lawsuits


Javascript coders acting like children again...


TL;DR - Brandon Nozaki Miller (Director of Front End Technology and Javascript Engineering @ Ocra) committed obfuscated code in the node-ipc package that runs geolocation and with probability 0.25 erases files at client computers if they have Russian or Byeeelorussian IPs.

Quite funny.


Might be funny at first, but its childish. Striking out maliciously at random web developers surrounded by state propaganda is counter-productive. This just annoys them and feeds the narrative that they're under attack by the West who hates them.

I would imagine web developers over there, being more educated, technical, and exposed to the West, would be the ones less likely to support the war.

Instead of deleting their files, why not provide news and information that being blocked? This could have been an information bridge that would be hard to censor.

Now he's just degraded trust in open-source projects for everyone and ruined his reputation as a responsible maintainer. If you're willing to make your project overtly malicious to random users for political reasons, you might also be the type to rage quit and turn your project malicious for personal reasons and community politics.


"feeds the narrative" - this is not a "narrative", this is reality




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: