Report a package

If a package is malware, deceives the people who install it, squats a name, infringes someone’s rights, or otherwise breaks the package policy, report it.

How

Open a new issue on FutureBlitz’s GitHub, from the link under Contact below, titled with the package’s name. An issue is public: anyone can read it, the package’s publisher too, and it shows the GitHub account that opened it.

For a report that shouldn’t be public, such as malware that’s still spreading, a security flaw, or a rights claim with personal details, use GitHub’s private vulnerability reporting on FutureBlitz’s repository instead. Only you and FutureBlitz’s maintainers see it. Either way, describe what a harmful package does in words, and leave working exploit code out.

What to say

• the package’s name, and the versions, as jsonkit 1.2.0;
• what’s wrong, and how you found it: the file and line, what it does, or what it copies;
• for a name or rights claim, who you are and what you hold; send that privately if you’d rather it weren’t public.

What happens

A maintainer looks at each report, harmful packages first. The registry’s admins delete a harmful version, which takes it out of the index and stops its downloads, and a squatted package’s versions, whose name then stays taken with nothing to add. The publisher hears why, and can ask once for the decision to be reconsidered. A public issue shows them who reported it; a private report is seen only by FutureBlitz’s maintainers.

A flaw in a package you publish

Yank the affected versions from the dashboard or with fb yank, publish a fixed version, and say which versions are affected in its readme.

Contact

Questions about these policies, and reports, go to a new issue on FutureBlitz's GitHub, which is public. A report that shouldn't be public goes to GitHub's private vulnerability reporting on FutureBlitz's repository, which only its maintainers see. The registry has no email address for them.