Where did these mysterious PrismJS npm versions come from?

• PrismJS

  59 12,002 0.0 JavaScript

  Lightweight, robust, elegant syntax highlighting.

  

  Loach raised a GitHub issue for the maintainers of PrismJS to unpublish these “broken” versions from npm, and this is where it gets interesting.

• updates

  1 95 9.0 JavaScript

  Flexible npm and poetry dependency update tool

  Another open-source CLI tool called updates, which checks for npm dependency updates, had to rewrite its version resolution logic to not pull the 9000.0.x versions.

• SurveyJS

  surveyjs.io

  sponsored

  Open-Source JSON Form Builder to Create Dynamic Forms Right in Your App. With SurveyJS form UI libraries, you can build and style forms in a fully-integrated drag & drop form builder, render them in your JS app, and store form submission data in any backend, inc. PHP, ASP.NET Core, and Node.js.

  

• rubygems

  211 3,545 9.9 Ruby

  Library packaging and distribution for Ruby.

  

  Why? Because it was malicious. Somebody had used it to pull a successful dependency confusion attack:

• RubyGems

  25 2,295 9.8 Ruby

  The Ruby community's gem hosting service.

  

  “Now every time someone [runs] bundle update, the RubyGems gem is installed instead of ours,” said developer, Adam Stankiewicz, who represents the official rails-assets.org service.

Suggest a related project