I'm putting on my security hat and making some comments about the overall design of the module and specifically about the test suite.
Time and again, we warn people about curl | bash
as an outstandingly boneheaded thing to do. One should never simply execute something that happens to be at the far end of a URL that one does not control, and that is generally accessible on the Internet, and hope everything will be okay.
But the reason that this module was pulled earlier was not that it does this -- though I would argue that even the basic idea of implementing a security vulnerability as a module is a terrible idea -- it was pulled because of all the following:
- the test suite accesses a site the installer does not control without warning them this will happen
- it obscures the site being used
- the code being downloaded is not the minimum possible needed to ensure that the test passes
- the code being downloaded is deliberately obfuscated to make it difficult for the installer to vet it for safety
- worst, the code that it currently downloads appears to be malware. (side note: it does not matter if it isn't! The fact that it is not blindingly obvious is in itself bad).
The combination of all these is not only unsafe but outright dangerous. I see from the authors answers that the inclusion of a reference to an iOS jailbreak was meant to be "funny". Production modules are not supposed to be this kind of funny.
Putting this in a non-Acme namespace is inappropriate if humor is the intention[1]. Also, there is absolutely no need to obfuscate the downloaded code.
Even if the author changes what it's loading to a cleartext dummy "hey look, I got installed" module, they'd still be weakening the security of every installation that used this module to be only as good as their security is. If you wanted to write a module like this, you would have to be prepared to take on that level of responsibility for every site that uses it. Even if you think you are prepared to do that, you are probably not.
A footgun that is the responsibility of the user to police is one thing. A footgun that is delivered loaded, with ammunition that might suddenly be something extremely dangerous, and which is actually fired during the test suite is wildly inappropriate.
Update: I've spoken directly to the author, who seems to be willing to make this right, and will be taking my advice on this module: moving it to Acme, changing the test to use a local HTTP server instead of the external one, and additionally requiring that the environment variable I_KNOW_THIS_IS_A_REMOTE_CODE_EXECUTION_VULNERABILITY_AND_I_AM_WILLING_TO_RISK_MY_JOB_AND_COMPANY
be set to a true value before the module will operate at all.
[1] CPAN uses the Acme
namespace as a place to put amusing/pointless/etc. modules.
perl -le'print 82.46.99.88'
shows that it corresponds toR.cX