[tar-fs is potentially compromised] Version 3.0.7 and 3.0.8 are released without any changes on GitHub

[SukkaW]

Is it intentional? Or is one of the collaborators compromised?

[lovell]

I was concerned about this too, but the following is the diff so this looks like a benign change that has not yet been pushed to GitHub.

122a123,124
>   cwd = path.resolve(cwd)
> 
218a221,223
>         const dst = path.resolve(path.dirname(name), header.linkname)
>         if (!inCwd(dst)) return next(new Error(name + ' is not a valid symlink'))
> 
226c231
<         const srcpath = path.join(cwd, path.join('/', header.linkname))
---
>         const dst = path.join(cwd, path.join('/', header.linkname))
228c233
<         xfs.link(srcpath, name, function (err) {
---
>         xfs.link(dst, name, function (err) {
230c235
<             stream = xfs.createReadStream(srcpath)
---
>             stream = xfs.createReadStream(dst)
236a242,245
>     }
> 
>     function inCwd (dst) {
>       return dst.startsWith(cwd)

[SukkaW]

Now 3.0.8 has also been released on NPM without any changes on GitHub. Since no one on the tar-stream and tar-fs team is responding to this, I believe both the tar-stream and tar-fs are compromised. I am going to pin the dependency version as well and suggest everyone else do the same.

[mafintosh]

didnt see, its fine, just forgot to push.

[mafintosh]

the team is one guy, me lol

[mafintosh]

Closed as not compromised

[mafintosh]

(pushed now)

[lovell]

Thank you Mathias!

[iBotPeaches]

@mafintosh - Our alerting went off again this time because 2.1.3 was published without corresponding GitHub tag/commit. We already diffed the npmjs release and nothing looks malicious, but if you could publish the source corresponding with the following tags:

491c491
<         xfs.realpath(srcpath, function (err, dst) {
---
>         xfs.link(srcpath, name, function (err) {
493c493
<           if (err || !dst.startsWith(path.resolve(cwd))) return next(new Error(name + ' is not a valid hardlink'))
---
>           if (err && err.code === 'EPERM' && opts.hardlinkAsFilesFallback) {
495,496c495
< 
<           xfs.link(dst, name, function (err) {
---
>             stream = xfs.createReadStream(srcpath)
498,500c497
<             if (err && err.code === 'EPERM' && opts.hardlinkAsFilesFallback) {
< 
<               stream = xfs.createReadStream(srcpath)
---
>             return onfile()
502c499
<               return onfile()
---
>           }
504d500
<             }
505a502
>           stat(err)
507,510d503
<             stat(err)
< 
<           })
< 

• v2.1.3
• v1.16.5

That would help the paranoia of our teams.

Perhaps if you are up for it - introduce provenance so we can correlate npm releases signed to the GitHub release - https://docs.npmjs.com/generating-provenance-statements would be the next evolution of this.