{"action":"created","issue":{"url":"https://api.github.com/repos/nodejs/node/issues/24664","repository_url":"https://api.github.com/repos/nodejs/node","labels_url":"https://api.github.com/repos/nodejs/node/issues/24664/labels{/name}","comments_url":"https://api.github.com/repos/nodejs/node/issues/24664/comments","events_url":"https://api.github.com/repos/nodejs/node/issues/24664/events","html_url":"https://github.com/nodejs/node/issues/24664","id":384596553,"node_id":"MDU6SXNzdWUzODQ1OTY1NTM=","number":24664,"title":"Node should stop bundling NPM","user":{"login":"thecodingdude","id":1025366,"node_id":"MDQ6VXNlcjEwMjUzNjY=","avatar_url":"https://avatars1.githubusercontent.com/u/1025366?v=4","gravatar_id":"","url":"https://api.github.com/users/thecodingdude","html_url":"https://github.com/thecodingdude","followers_url":"https://api.github.com/users/thecodingdude/followers","following_url":"https://api.github.com/users/thecodingdude/following{/other_user}","gists_url":"https://api.github.com/users/thecodingdude/gists{/gist_id}","starred_url":"https://api.github.com/users/thecodingdude/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thecodingdude/subscriptions","organizations_url":"https://api.github.com/users/thecodingdude/orgs","repos_url":"https://api.github.com/users/thecodingdude/repos","events_url":"https://api.github.com/users/thecodingdude/events{/privacy}","received_events_url":"https://api.github.com/users/thecodingdude/received_events","type":"User","site_admin":false},"labels":[{"id":195452799,"node_id":"MDU6TGFiZWwxOTU0NTI3OTk=","url":"https://api.github.com/repos/nodejs/node/labels/npm","name":"npm","color":"fad8c7","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-11-27T02:48:26Z","updated_at":"2018-11-27T03:50:08Z","closed_at":null,"author_association":"NONE","body":"This is a byproduct of #24663 aimed at providing an actionable measure Node can take to increase the security of its users.\r\n\r\nNPM is very capable but very powerful, we recently saw a package got compromised and did a number of bad things, [here's](https://github.com/dominictarr/event-stream/issues/116#issuecomment-441746370) a technical breakdown and [here's](https://github.com/dominictarr/event-stream/issues/116#issuecomment-441759047) a simplified one.\r\n\r\nThey were able to gather information, and send it to a remote server. \r\n\r\nNPM has not addressed this issue, they haven't acknowledged it publicly.\r\nThey have NO security whatsoever, automated, human or otherwise. \r\n\r\nThere were many, many flags where this could have been caught and required human intervention.\r\n\r\nThis is NOT NPM's first blunder, and has happened a few times now (leftpad, anyone?).\r\n\r\nNPM is insecure, and Node should NOT be shipping it without some serious changes to protect users. Anything less is gross negligence on the foundation for knowingly shipping software that can target users in this way."},"comment":{"url":"https://api.github.com/repos/nodejs/node/issues/comments/441893325","html_url":"https://github.com/nodejs/node/issues/24664#issuecomment-441893325","issue_url":"https://api.github.com/repos/nodejs/node/issues/24664","id":441893325,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MTg5MzMyNQ==","user":{"login":"MylesBorins","id":498775,"node_id":"MDQ6VXNlcjQ5ODc3NQ==","avatar_url":"https://avatars1.githubusercontent.com/u/498775?v=4","gravatar_id":"","url":"https://api.github.com/users/MylesBorins","html_url":"https://github.com/MylesBorins","followers_url":"https://api.github.com/users/MylesBorins/followers","following_url":"https://api.github.com/users/MylesBorins/following{/other_user}","gists_url":"https://api.github.com/users/MylesBorins/gists{/gist_id}","starred_url":"https://api.github.com/users/MylesBorins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MylesBorins/subscriptions","organizations_url":"https://api.github.com/users/MylesBorins/orgs","repos_url":"https://api.github.com/users/MylesBorins/repos","events_url":"https://api.github.com/users/MylesBorins/events{/privacy}","received_events_url":"https://api.github.com/users/MylesBorins/received_events","type":"User","site_admin":false},"created_at":"2018-11-27T03:50:08Z","updated_at":"2018-11-27T03:50:08Z","author_association":"MEMBER","body":"To be very clear. I think this issue should be closed and after this comment I will not be responding.\r\n\r\n @thecodingdude I want to believe that you are coming from a good place in opening these issues, but the way you have chosen to engage does not immediately come across as good faith to me. I'd like to suggest you step back and think of more constructive ways to get involved, I've pointed some of them out above."}}
{"actor":{"display_login":"MylesBorins"}}