NVD - CVE-2022-23812 - A 9.8 critical vulnerability caused by a node library author adding code into his package which has a 1 in 4 chance of wiping the files of a system if it's IP comes from Russia or Belarus

• node-ipc

  76 41 2.3 JavaScript

  A nodejs module for local and remote Inter Process Communication (IPC), Neural Networking, and able to facilitate machine learning. (by RIAEvangelist)

The author has gone rogue, and the API key got disabled. The author seems to muddy the water by ghost-editing others' comments (https://github.com/RIAEvangelist/node-ipc/issues/233) and repeatedly lie (https://github.com/vuejs/vue-cli/issues/7054#issuecomment-1068541634) on the platform.

• tiny-http

  5 955 1.5 Rust

  Low level HTTP server library in Rust

  

That's not a simple http server, something like tiny_http would be with only... 17 total dependencies by default. Actix is a full framework with an abundance of features, and correspondingly-large dependency tree.

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• cargo-crev

  55 2,030 7.9 Rust

  A cryptographically verifiable code review system for the cargo (Rust) package manager.

  

I just checked actix-web myself. It pulls in 125 crates normally, and 108 crates with default-features = false, not counting duplicate versions. More important, though is the number of independent crate owners (40 for actix-web per cargo-crev), since many crates in Cargo depend on associated utility crates from the same owner. The main cultural issue with NPM is that package authors frequently pull in minor packages from other authors, and so on.

• peacenotwar

  33 155 7.0 JavaScript

  Discontinued Attempts to determine if the computer its running on has an IP originating from Russia or Belarus. If it is then depending on the version of the malware either attempts to delete all files on the computer, or creates a text file on the computers desktop protesting the war in ukraine.

Or, for that matter, impacts people who are working against the war.

Suggest a related project