2-day-old GitHub account added AI-generated dependency to Mailgen (2.5k stars)
hackernews
|
|
📦 오픈소스
#review
원문 출처: hackernews · Genesis Park에서 요약 및 분석
요약
생성 2일 된 계정이 스타 2,500개 이상의 Mailgen 저장소에 의존성을 추가하는 PR을 올렸으나, 공급망 공격 우려로 인해 거부되었습니다. 해당 계정은 성능 향상을 명분으로 `turbo-he` 패키지를 제안했지만, AI로 생성된 것으로 추정되는 의존성을 악용하려는 시도로 간주되었습니다. 이에 기여자는 즉시 PR을 되돌리고, 향후 의존성 변경 사항을 면밀히 검토하겠다고 밝혔습니다.
본문
Conversation | @eladnava I tried to contact you privately via linkedin and twitter but can't seem to (because of permissions on your end and linkedin restrictions I think). I'd strongly suggest you revert this PR. This account was created ~2 days ago, has vibed some "performant" NPM dependencies into existence, and while the package contents seems innocuous, I suspect they're attempting to set up a supply chain attack. | | @askoufis I've also deprecated version Really appreciate your vigilance and quick notification about this potential future supply chain attack. Going forward, I will be carefully reviewing any PRs which touch any of the existing Thanks again! | What this does Replaces he withturbo-he — a Rust N-API implementation of the identical API. One line inpackage.json , one line per import. No logic changes.Benchmark results (Apple M2, Node.js v25.2.1) he turbo-he decodeBuffer(Buffer) ★useNamedReferences: true Why it's safe he on every case: named entities, numeric decimal/hex, legacy no-semicolon, attribute-value mode, strict mode, Windows-1252 remap, surrogate replacementhe he )Source: https://github.com/dev-kjma/turbo-he · https://www.npmjs.com/package/turbo-he
Genesis Park 편집팀이 AI를 활용하여 작성한 분석입니다. 원문은 출처 링크를 통해 확인할 수 있습니다.
공유