Publish debug@4.4.3 to avoid cached versions

[lizardkinger]

Hi,

similar to https://github.com/Qix-/node-error-ex/issues/18, could you publish a follow-up version after the pulled package?

As stated for node-error-ex:

The problem is that many private registries (Nexus, Artifactory, Verdaccio, etc.) have already mirrored 1.3.3.
This leads to issues when consumers resolve '^1.3.1' or '^1.3.2', because some environments still use the 1.3.3.

Ran into that problem (clean build with local npm cache cleared) today when using a private registry that debug@4.4.2 is still being available and due to the caret ranges, debug is being pulled in transitively by other libraries.

[msmp1]

I have the same issue. It's hard to hack a fix because the package I want to install goes globally, so overriding isn't viable. This would help us move on.

[Qix-]

Hi @lizardkinger - I figured this might be a problem. After everything happened I didn't want to push anything else, simply out of fear and not knowing what the effects would be at this scale right when everything was on fire.

I'm exhausted after the last few days, let me learn from my mistake and publish a new version tomorrow when I've gotten some rest (as it's 22:45 currently). I apologize for the headache!

[Ghislain89]

Heya @Qix- , We are also affected by this and would appreciate this new publish as well. Fully understand the reluctance to do this earlier though. Hope you're able to get some rest after this.

[Qix-]

Thank you! Yes it's on my list today. Still waking up, had a late start. Will post here when it's done.

[Ghislain89]

Highly appreciated!

[Qix-]

Hi, something still isn't right with my account configuration. Going to hold off on the package updates until I can receive a response from npm.

There is no threat or continued breach, but I'm not able to publish in a way I'm confident will be secure quite yet. Please bear with.

[Ghislain89]

Thanks for the update. In parallel I am trying to get our corporate overlords to invalidate the caches for our nexus instance.

Hope the account gets sorted soon!