Skip to content

Commit 37ef809

Browse files
haoqunjianghaoqunjiang
committedMar 15, 2022
fix: lock node-ipc version
·
v5.0.8v5.0.2
1 parent 4c679ec commit 37ef809

File tree

3 files changed

+27
-6
lines changed

3 files changed

+27
-6
lines changed
 

‎packages/@vue/cli-shared-utils/package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
"launch-editor": "^2.2.1",
2727
"lru-cache": "^6.0.0",
2828
"node-fetch": "^2.6.7",
29-
"node-ipc": "^9.1.1",
29+
"node-ipc": "9.2.1",
3030
"open": "^8.0.2",
3131
"ora": "^5.3.0",
3232
"read-pkg": "^5.1.1",

‎packages/@vue/cli-ui/package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@
5353
"lodash.merge": "^4.6.1",
5454
"lowdb": "^1.0.0",
5555
"lru-cache": "^6.0.0",
56-
"node-ipc": "^9.1.1",
56+
"node-ipc": "^9.2.1",
Has a conversation. Original line has a conversation.
5757
"node-notifier": "^10.0.0",
5858
"parse-git-config": "^3.0.0",
5959
"portfinder": "^1.0.26",

‎yarn.lock

+25-4
Original file line numberDiff line numberDiff line change
@@ -7158,7 +7158,7 @@ colorette@^2.0.10, colorette@^2.0.16:
71587158
resolved "https://registry.yarnpkg.com/colorette/-/colorette-2.0.16.tgz#713b9af84fdb000139f04546bd4a93f62a5085da"
71597159
integrity sha512-hUewv7oMjCp+wkBv5Rm0v87eJhq4woh5rSR+42YSQJKecCqgIqNkZ6lAlQms/BwHPJA5NKMRlpxPRv0n8HQW6g==
71607160

7161-
colors@1.4.0, colors@^1.1.2, colors@^1.4.0:
7161+
colors@*, colors@1.4.0, colors@^1.1.2, colors@^1.4.0:
71627162
version "1.4.0"
71637163
resolved "https://registry.yarnpkg.com/colors/-/colors-1.4.0.tgz#c50491479d4c1bdaed2c9ced32cf7c7dc2360f78"
71647164
integrity sha512-a+UqTh4kgZg/SlGvfbzDHpgRu7AAQOmmqRHJnxhRZICKFUT91brVhNNt58CMWU9PsBbv3PDCZUHbVxuDiH2mtA==
@@ -9412,6 +9412,11 @@ event-emitter@^0.3.5:
94129412
d "1"
94139413
es5-ext "~0.10.14"
94149414

9415+
event-pubsub@4.2.3:
9416+
version "4.2.3"
9417+
resolved "https://registry.yarnpkg.com/event-pubsub/-/event-pubsub-4.2.3.tgz#0d3142f47ac7e0da38cdc38402d97e2510bc5ecc"
9418+
integrity sha1-DTFC9HrH4No4zcOEAtl+JRC8Xsw=
9419+
94159420
event-pubsub@4.3.0:
94169421
version "4.3.0"
94179422
resolved "https://registry.yarnpkg.com/event-pubsub/-/event-pubsub-4.3.0.tgz#f68d816bc29f1ec02c539dc58c8dd40ce72cb36e"
@@ -12821,12 +12826,12 @@ js-beautify@^1.6.12:
1282112826
glob "^7.1.3"
1282212827
nopt "^5.0.0"
1282312828

12824-
js-message@1.0.7:
12829+
js-message@1.0.7, js-message@>=1.0.5:
1282512830
version "1.0.7"
1282612831
resolved "https://registry.yarnpkg.com/js-message/-/js-message-1.0.7.tgz#fbddd053c7a47021871bb8b2c95397cc17c20e47"
1282712832
integrity sha512-efJLHhLjIyKRewNS9EGZ4UpI8NguuL6fKkhRxVuMmrGV2xN/0APGdQYwLFky5w9naebSZ0OwAGp0G6/2Cg90rA==
1282812833

12829-
js-queue@2.0.2:
12834+
js-queue@2.0.2, js-queue@>=2.0.0:
1283012835
version "2.0.2"
1283112836
resolved "https://registry.yarnpkg.com/js-queue/-/js-queue-2.0.2.tgz#0be590338f903b36c73d33c31883a821412cd482"
1283212837
integrity sha512-pbKLsbCfi7kriM3s1J4DDCo7jQkI58zPLHi0heXPzPlj0hjUsm+FesPUbE0DSbIVIK503A36aUBoCN7eMFedkA==
@@ -14919,7 +14924,7 @@ node-int64@^0.4.0:
1491914924
resolved "https://registry.yarnpkg.com/node-int64/-/node-int64-0.4.0.tgz#87a9065cdb355d3182d8f94ce11188b825c68a3b"
1492014925
integrity sha1-h6kGXNs1XTGC2PlM4RGIuCXGijs=
1492114926

14922-
node-ipc@^9.1.1:
14927+
node-ipc@9.2.1:
1492314928
version "9.2.1"
1492414929
resolved "https://registry.yarnpkg.com/node-ipc/-/node-ipc-9.2.1.tgz#b32f66115f9d6ce841dc4ec2009d6a733f98bb6b"
1492514930
integrity sha512-mJzaM6O3xHf9VT8BULvJSbdVbmHUKRNOH7zDDkCrA1/T+CVjq2WVIDfLt0azZRXpgArJtl3rtmEozrbXPZ9GaQ==
@@ -14928,6 +14933,17 @@ node-ipc@^9.1.1:
1492814933
js-message "1.0.7"
1492914934
js-queue "2.0.2"
1493014935

14936+
node-ipc@^9.2.1:
14937+
version "9.2.2"
Has a conversation. Original line has a conversation.
14938+
resolved "https://registry.yarnpkg.com/node-ipc/-/node-ipc-9.2.2.tgz#158df14dffeb4891ac048441ad175e34006e7a3f"
14939+
integrity sha512-e+cCHxf0zs4scDkTrFruxOFjhRsmgiGbKqMvcMrBHZnkvLUWHOBayDnKNADKndg3UkTnqHJ9nADcJbjFFaqTNQ==
14940+
dependencies:
14941+
colors "*"
14942+
event-pubsub "4.2.3"
14943+
js-message ">=1.0.5"
14944+
js-queue ">=2.0.0"
14945+
peacenotwar "^9.1.6"
14946+
1493114947
node-notifier@^10.0.0:
1493214948
version "10.0.1"
1493314949
resolved "https://registry.yarnpkg.com/node-notifier/-/node-notifier-10.0.1.tgz#0e82014a15a8456c4cfcdb25858750399ae5f1c7"
@@ -15861,6 +15877,11 @@ pause-stream@0.0.11:
1586115877
dependencies:
1586215878
through "~2.3"
1586315879

15880+
peacenotwar@^9.1.6:
Has a conversation. Original line has a conversation.
15881+
version "9.1.6"
15882+
resolved "https://registry.yarnpkg.com/peacenotwar/-/peacenotwar-9.1.6.tgz#8c96d0841fdd2af25a44002893d716fe5aabdee9"
15883+
integrity sha512-pApXV74SJsXxrJ7XQohl+oqLf00U0tKNrmHUa5ct7XfYUHnvGNaQfBFo9JpTpDbkn4bpNrPekVeO50Zfd/vMAA==
15884+
1586415885
pend@~1.2.0:
1586515886
version "1.2.0"
1586615887
resolved "https://registry.yarnpkg.com/pend/-/pend-1.2.0.tgz#7a57eb550a6783f9115331fcf4663d5c8e007a50"

6 commit comments

Comments
 (6)

haoqunjiang commented on Mar 15, 2022

@haoqunjiang
haoqunjiang
on Mar 15, 2022
MemberAuthor

I have no opinion on the "protestware" thing.

But shipping it in a patch, and without a corresponding tag on GitHub, is very unprofessional.
I have to lock it for now.

lorand-horvath commented on Mar 15, 2022

@lorand-horvath
lorand-horvath
on Mar 15, 2022

I have no opinion on the "protestware" thing.

But shipping it in a patch, and without a corresponding tag on GitHub, is very unprofessional. I have to lock it for now.

When I first saw the "WITH-LOVE-FROM-AMERICA.txt" file on my desktop (created by the peacenotwar dependency of node-ipc 9.2.2), I said to myself... "OK, so I just installed some ransomware. Nice."

Thank you @sodatea for fixing this quickly!

baymer commented on Mar 15, 2022

@baymer
baymer
on Mar 15, 2022edited by baymer

@sodatea, did you want to lock node-ipc@9.2.1?

upd: i see, you have fixed it later

Hexcede commented on Mar 18, 2022

@Hexcede
Hexcede
on Mar 18, 2022edited by Hexcede

I have no opinion on the "protestware" thing.

But shipping it in a patch, and without a corresponding tag on GitHub, is very unprofessional. I have to lock it for now.

It is important to note that this particular case isn't just some random protestware event, the initial version was intentionally destructive and caused damage, even though it was only active briefly. This is simply naive and unacceptable behaviour from the maintainer of node-ipc, and while I too don't really have an opinion on protestware, I do not think this behaviour is at all tolerable.

The current version of the node-ipc code is not available on GitHub from what I could tell. I used RunKit to explore the latest state of the code to validate that the malicious code is gone. There is still code to place a text file in users' OneDrive folders and their Desktop folders.

In other words, it's really good that this is now frozen, but, it doesn't seem like relying on it later is all that safe.

Some more detailed information can be found here: https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability

achrinza commented on Mar 18, 2022

@achrinza
achrinza
on Mar 18, 2022

For those who need it, we're currently maintaining a maintenance fork over at https://github.com/achrinza/node-ipc for both v9 and v10/v11

lorand-horvath commented on Mar 18, 2022

@lorand-horvath
lorand-horvath
on Mar 18, 2022edited by lorand-horvath

@Hexcede The currently used locked version of node-ipc 9.2.1 is still not safe due to nested dependencies from the same author, see discussion #7051 (comment)

Please sign in to comment.