Security concerns: linking to an npm package that doesn't link back to this repo

[jimthedev]

@gustavohenke It looks like you are trying to update this package but just haven't published successfully yet. That's great that you are working on it. With that said, I got a bit of a scare today.

What caused me concern is that the npm package package page (https://www.npmjs.com/package/chokidar-cli) points to an org/repo that is not legitimate (open-cli-tools/chokidar-cli) and at first when looking at the content of that repo it seemed to indicate that someone else has control of the source code.

Upon further review I don't think there is any malicious code in the npm package to indicate that they were able to publish, but rather it seems like a case of name squatting on github. It appears previous maintainers renamed the organization and someone was able to snag the old org name (open-npm-tools) and these new owners of that org are saying that they've been able to 'take over' the old org name.

I don't think they can actually do any harm except make people worried, but if we could get a good publish to npm with the now updated homepage and repo fields in the package.json then it might make people a bit less freaked out and thinking that they are pwnd.

Just a heads up. Let me know if you need any help.

[gustavohenke]

Hey! Yeah, this one has been known for some days. I hit some snag when updating things, then didn't come back to it.

I've pushed some changes and a new tag, but I don't think I have publish access on npm. @aivenkimmob / @kimmobrunfeldt?

[stee-re]

I was a little freaked out about this too.
Looks like this Repo previously lived here:
https://github.com/open-npm-tools/chokidar-cli
The redirect to
https://github.com/open-npm-tools/chokidar-clis
Just made it all look malicous!
I only figured this out when I forked the project and took a look at the git history.

Unfortunately I had already raised a security alert with NPM about this because I've been using it in my projects and freaked out - rightly so, this has all the hall marks of something malicous.

All of this could have been avoided if Repo https://github.com/open-npm-tools/chokidar-clis had something sensible in the readme.md like:

This project has been moved to https://github.com/open-cli-tools/chokidar-cli.