Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you security-audit external software using NPM packages?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 85 posts

Re: Ask HN: How do you security-audit external software using NPM packages?

#21

Post by apples_oranges »

TekMol wrote: post #3

Independent of the language, I only use external code if it is small enough that I can manually review it. Often I refactor it into a single file during this process. This of course excludes the majority of packages out there. But apart from security, it has another benefit: These dependency very rarely break and need updates. So compared to projects with a more complex stack, projects with a lean stack are easier to…

Refactoring into a single file sounds like a bit of a pain, since you have to do it every time the external code gets updated. Also how do you deal with dependencies that come with their own dependencies? Do you avoid them?

Re: Ask HN: How do you security-audit external software using NPM packages?

#22

Post by bjpirt »

We've been using trivy [1] to audit the container builds we've been producing for a relatively security focussed project. As well as scanning for OS package level vulnerabilities it also scans for reported vulnerabilities in NPM packages. Works well for us.

But the other complementary approach is to lock down other things - so for example, if you're running in a container, make sure that container can only talk to the proxy in front of it. That way, even if there was some kind of malicious code running in one of the modules, there's no way for any data to get in or out (unless it finds a way of injecting into any web input/output, but then you need to be scanning for that too)

[1] https://github.com/aquasecurity/trivy

Re: Ask HN: How do you security-audit external software using NPM packages?

#23

Post by BjornW »

TekMol wrote: post #5
BjornW wrote: post #2

A WordPress plugin may contain hundreds of interdependent npm packages all neatly bundled and minified. Without access to a package.json or package-lock.json it is quite hard to find out which individual packages have been used. Quite often there is also no public repo available of the development files. To give an example of my process thus far: Someone in my team wants to see if we can use plugin X. I’m downloading…

My first question here would be: What is the attack vector you are worried about? If your wordpress instance is taken over, what is the problem? That the intruder gains access to data they should not have? Or that they will use your machine in some way that would harm you?

There are multiple attack vectors I can think of, although most can be mitigated using other security measures. I don't want to rely on audits only off course. To give you an example: using the WordPress environment as a stepping stone to gain more access, running client-side software without out permission (stealing data from visitors, our resources e.g. crypto miners), defacement/fake-news, etc.

Re: Ask HN: How do you security-audit external software using NPM packages?

#24

Post by orangepanda »

KronisLV wrote: post #19
orangepanda wrote: post #6

Is there really anything better than `npm audit`, even with all its faults? Any relatively popular and well tested library will pull in dozens of dependencies. $ du -hs node_modules 289M node_modules Yeah no...

> Yeah no... That is only a valid stance to take while you're developing most of the "regular" software out there, but once you start dealing with finance data in an industry that's highly concerned with compliance and security you might get more demands forced upon you in regards to what you can or cannot do. That's not to say that there exists a better auditing mechanism, short of allotting a large amount of your t…

> That is only a valid stance to take while you're developing most of the "regular" software out there, but once you start dealing with finance data in an industry that's highly concerned with compliance and security you might get more demands forced upon you in regards to what you can or cannot do.

I'd think financial institutions would avoid such a scenario entirely? The work cant also easily be split up - just because two libraries are correct doesnt mean both of them together are correct.

Re: Ask HN: How do you security-audit external software using NPM packages?

#25

Post by BjornW »

robin_reala wrote: post #13

You’re primarily talking about proactive auditing here, but if something does sneak in you’ve got problems. In the best spirit of layered security you should also build up a strong Content Security Policy and include that with your pages to make sure that there’s a whitelist of the servers the page can talk so, and that technologies you know you’re not using are locked down.

I agree. Pro-active audits will only go so far, there is definitely a need for other measures (which are implemented as well). A Content-Security-Policy is as far as I know still really hard to implement well (as in truly protecting assets instead of being a policy tick-off) on WordPress with external plugins and themes. Sadly, a CSP will not protect against attacks running on a post npm install in your development environment, as this is also a risk of using npm packages.

Re: Ask HN: How do you security-audit external software using NPM packages?

#26

Post by danielsamuels »

TekMol wrote: post #3

Independent of the language, I only use external code if it is small enough that I can manually review it. Often I refactor it into a single file during this process. This of course excludes the majority of packages out there. But apart from security, it has another benefit: These dependency very rarely break and need updates. So compared to projects with a more complex stack, projects with a lean stack are easier to…

> It would be great if there was a "single small file packages" movement so that more lean open source software will be created.

There are certainly npm authors doing this already, feross[1] is a good example. That means you get packages like is-buffer[2].

[1]: https://www.npmjs.com/~feross [2]: https://github.com/feross/is-buffer/blob/master/index.js

Re: Ask HN: How do you security-audit external software using NPM packages?

#27

Post by englund »

evandwight wrote: post #17

Can you reverse lookup the packages using the abstract syntax tree? Most of it's probably from the top 10,000 packages.

I've built https://bundlescanner.com which is similar what you're describing. It has indexed 35,000 of the most popular npm packages. However, it is not accurate enough to reliably identify which specific version of a package is present in a js bundle.

I'd be curious to hear if anyone can think of possible applications of it in security auditing.

Re: Ask HN: How do you security-audit external software using NPM packages?

#28

Post by KronisLV »

orangepanda wrote: post #24
KronisLV wrote: post #19

Earlier quoted context omitted.

> Yeah no... That is only a valid stance to take while you're developing most of the "regular" software out there, but once you start dealing with finance data in an industry that's highly concerned with compliance and security you might get more demands forced upon you in regards to what you can or cannot do. That's not to say that there exists a better auditing mechanism, short of allotting a large amount of your t…

> That is only a valid stance to take while you're developing most of the "regular" software out there, but once you start dealing with finance data in an industry that's highly concerned with compliance and security you might get more demands forced upon you in regards to what you can or cannot do. I'd think financial institutions would avoid such a scenario entirely? The work cant also easily be split up - just bec…

> I'd think financial institutions would avoid such a scenario entirely?

Then you'd only be relying on either the standard library, or packages that you (the company) have written yourself, which has a completely different set of challenges - everything from it being impossible to find people who know your internal libraries, to documentation and tests becoming a challenge etc.

Re: Ask HN: How do you security-audit external software using NPM packages?

#29

Post by TekMol »

danielsamuels wrote: post #26
TekMol wrote: post #3

Independent of the language, I only use external code if it is small enough that I can manually review it. Often I refactor it into a single file during this process. This of course excludes the majority of packages out there. But apart from security, it has another benefit: These dependency very rarely break and need updates. So compared to projects with a more complex stack, projects with a lean stack are easier to…

> It would be great if there was a "single small file packages" movement so that more lean open source software will be created. There are certainly npm authors doing this already, feross[1] is a good example. That means you get packages like is-buffer[2]. [1]: https://www.npmjs.com/~feross [2]: https://github.com/feross/is-buffer/blob/master/index.js

What I would do if I wanted to use "is-buffer" is I would copy this index.js to a new file called "isBuffer.js" and it would look like this:

    export function isBuffer (obj) {
        return obj != null && obj.constructor != null &&
        typeof obj.constructor.isBuffer === 'function' &&
        obj.constructor.isBuffer(obj)
    }
Imho, there is no need to pull 10 files into my project to use one function.

Re: Ask HN: How do you security-audit external software using NPM packages?

#30

Post by danielsamuels »

TekMol wrote: post #29
danielsamuels wrote: post #26

Earlier quoted context omitted.

> It would be great if there was a "single small file packages" movement so that more lean open source software will be created. There are certainly npm authors doing this already, feross[1] is a good example. That means you get packages like is-buffer[2]. [1]: https://www.npmjs.com/~feross [2]: https://github.com/feross/is-buffer/blob/master/index.js

What I would do if I wanted to use "is-buffer" is I would copy this index.js to a new file called "isBuffer.js" and it would look like this: export function isBuffer (obj) { return obj != null && obj.constructor != null && typeof obj.constructor.isBuffer === 'function' && obj.constructor.isBuffer(obj) } Imho, there is no need to pull 10 files into my project to use one function.

You would, of course, preserve the copyright and license notices too. Otherwise that would be a violation of the license.
Post reply on HN