Sudden package retirement without announcement: What's going on?

[JesseHerrick]

Hi Earmark team,

We noticed that Earmark has retired all of its packages without any announcement. The message is recommending switching to mdex. This smells to me like a supply chain attack, especially since mdex uses a Rust NIF which downloads a binary for use.

Could you please weigh in on this? Why was there no announcement about this sudden retirement of all packages? Is this a supply chain attack by a compromised account?

[maennchen]

Cross Posting from the Elixir Forum (https://elixirforum.com/t/earmark-suddenly-retired-all-versions-in-hex-pm-supply-chain-attack/75698/10):

A bit of context from my side:

We were in contact with the maintainer about a CVE and also offered to send patches for the vulnerability.

Unfortunately, the currently remaining maintainer does not want to continue maintaining the package. After checking with multiple of the largest users of Earmark, they also decided to switch libraries instead of taking over maintainership.

Because of that, we decided together with the maintainer that retiring the releases was the best course of action. I was added to the package by the current maintainer so that I could support retiring the releases.

This does not mean that the library name is burned. If someone would like to pick up maintenance, this package can still continue to exist. Please reach out to support@hex.pm if you would like to take it over. The retirement can also be removed if the package is maintained again.

[tomasz-tomczyk]

@maennchen that forum link is giving a 404

What's the suggested alternative? Thanks!

Edit: just noticed https://hex.pm/packages/earmark has a suggestion to move to MDex - ignore me. (although might be worthwhile putting at the top of README 🤷 )

[maennchen]

@tomasz-tomczyk It looks like the forum post was hidden for non-participants. I don’t know why.

I don’t have write access to the GH repository, but I agree a note in the README and archiving the repo would be best.

[lpil]

Is retiring the package before an alternative is available a little premature? MDex is a Rust NIF so is not a suitable alternative for many projects, leaving many folks with no option but to ignore the retirement warnings and disable deps auditing.

[maennchen]

@lpil I don’t think the retirement was premature.

The maintainer had already been clear before this that they no longer had time to maintain Earmark. The community had time to step up, and it still can. If someone wants Earmark to continue as a maintained library, now is the time to step up.

The retirement is meant as a strong signal. If people want this library, this is the moment for someone to take over maintenance. If nobody does, then the retirement is also a strong signal to users that they should start looking for alternatives instead of assuming the package will keep being maintained.

[lpil]

Ah I see! I wasn't aware that it was previously unmaintained and that had been publicly known.