Applications

[sancarn]

Add any applications below

[zttAsoiaf]

I want to maintain this node-global-key-listener project. and I feel it a pity that it is closed. I am good at node and familiar with git and github. I have a Windows computer, a mac and a Linux. I am not familiar with Keyboard hooking, but I am interested in it. So I want to try to maintain this project.

[sancarn]

@zttAsoiaf awesome news :) We think the best course of action is as follows:

You could release it under a new package name on npm. We're happy to signpost (create a link in our readme which directs users to your new package).

We feel this will be:

1. Easier for us too
2. Gives existing users some security guarantees which transferring ownership wouldn't

[zttAsoiaf]

@sancarn I have registered an npm account. What should I do next?

[definecampus]

@sancarn Are you still looking for new maintainer? I am very interested.

[sancarn]

Hi both, not sure if @zttAsoiaf followed through, and @zttAsoiaf I'm sorry for not replying to you sooner.

There are tutorials out there on how to publish NPM packages e.g:

https://zellwk.com/blog/publish-to-npm/

@ooohmike Again, I reiterate what I said to @zttAsoiaf. Due to the nature of this package we don't feel it is right to simply allow takeover of the node-global-key-listener. Our reasoning is as follows:

1. node-global-key-listener is already installed as part of numerous systems.
2. node-global-key-listener has direct access to C APIs without any permission requests.
3. As such to we feel like direct handover may create a security incident similar to the likes of that in March 2024 with Jia Tan and XZ Utils backdoor.

Both myself and @TarVK are uncomfortable with this, and as such we recommend releasing a fork as its own npm package.

Again, we will happily signpost to the new fork in our READMEs on NPM, and look into adding a deprecation message on the module's install script.