Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you security-audit external software using NPM packages?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 85 posts

Re: Ask HN: How do you security-audit external software using NPM packages?

#31

Post by jhugo »

As much as the JS ecosystem terrifies me, Node isn't really the problem here. Receiving plugins that contain minified blobs of JS is, practically, quite equivalent to receiving plugins that contain binary blobs.

If you accept receiving and using plugins that contain unauditable blobs of software, whether it's minified JS or a binary, a good-quality audit is going to be virtually impossible.

In many other ecosystems this wouldn't be normal. If a Rust crate ships binary blobs with no easy access to source code, I wouldn't ever consider depending on it.

If you can't prevent these blobs from infecting your system, you have to deal with the risk another way – locked-down containers on the server side, strict CSPs on the client side, and monitoring.

Re: Ask HN: How do you security-audit external software using NPM packages?

#32

Post by TekMol »

apples_oranges wrote: post #21
TekMol wrote: post #3

Independent of the language, I only use external code if it is small enough that I can manually review it. Often I refactor it into a single file during this process. This of course excludes the majority of packages out there. But apart from security, it has another benefit: These dependency very rarely break and need updates. So compared to projects with a more complex stack, projects with a lean stack are easier to…

Refactoring into a single file sounds like a bit of a pain, since you have to do it every time the external code gets updated. Also how do you deal with dependencies that come with their own dependencies? Do you avoid them?

    every time the external code gets updated
I do not keep my fork in sync afterwards.

    dependencies that come with
    their own dependencies
Depends on the dependencies. If you give me an example, I can tell you what I would do.

Re: Ask HN: How do you security-audit external software using NPM packages?

#33

Post by TekMol »

danielsamuels wrote: post #30
TekMol wrote: post #29

Earlier quoted context omitted.

What I would do if I wanted to use "is-buffer" is I would copy this index.js to a new file called "isBuffer.js" and it would look like this: export function isBuffer (obj) { return obj != null && obj.constructor != null && typeof obj.constructor.isBuffer === 'function' && obj.constructor.isBuffer(obj) } Imho, there is no need to pull 10 files into my project to use one function.

You would, of course, preserve the copyright and license notices too. Otherwise that would be a violation of the license.

Yes, in this case I would put something like this on top of the file:

    # Fork by TekMol of https://github.com/feross/is-buffer
    # Which is MIT licensed by Feross Aboukhadijeh
I am actually never completely sure how to properly do this. Would the next forker write the following then?

    # Fork by Joe of https://github.com/tekmol/isBuffer
    # Which is a fork by TekMol of https://github.com/feross/is-buffer
    # Which is MIT licensed by Feross Aboukhadijeh

Re: Ask HN: How do you security-audit external software using NPM packages?

#34

Post by duckmysick »

bjpirt wrote: post #22

We've been using trivy [1] to audit the container builds we've been producing for a relatively security focussed project. As well as scanning for OS package level vulnerabilities it also scans for reported vulnerabilities in NPM packages. Works well for us. But the other complementary approach is to lock down other things - so for example, if you're running in a container, make sure that container can only talk to th…

> make sure that container can only talk to the proxy in front of it

Is there a tool like trivy that can help with that?

Re: Ask HN: How do you security-audit external software using NPM packages?

#35

Post by blorgle »

duckmysick wrote: post #34
bjpirt wrote: post #22

We've been using trivy [1] to audit the container builds we've been producing for a relatively security focussed project. As well as scanning for OS package level vulnerabilities it also scans for reported vulnerabilities in NPM packages. Works well for us. But the other complementary approach is to lock down other things - so for example, if you're running in a container, make sure that container can only talk to th…

> make sure that container can only talk to the proxy in front of it Is there a tool like trivy that can help with that?

network namespaces and any reverse proxy :)

Re: Ask HN: How do you security-audit external software using NPM packages?

#36

Post by allendoerfer »

thih9 wrote: post #7
politelemon wrote: post #4

It's not free, we're using Whitesource which provides alerts against libraries being used in the codebase. It can scan package.json, but it can also scan individual files. It matches the hashes of those files with those from open source projects so it usually able to identify which library that file came from, or at least where it was first seen. That way the package.json isn't always needed.

Does it recognize hashes of proprietary (closed source, minified) files too?

Nope, it does not. If you remove the comment at the beginning of an unminified JS file, it will not recognize it as outdated anymore. You should treat WhiteSource as something that can potentially help to find problems, but it will by no means grant you security on its own. It is an enterprise tool to help people check boxes.

Re: Ask HN: How do you security-audit external software using NPM packages?

#37

Post by TekMol »

BjornW wrote: post #23
TekMol wrote: post #5

Earlier quoted context omitted.

My first question here would be: What is the attack vector you are worried about? If your wordpress instance is taken over, what is the problem? That the intruder gains access to data they should not have? Or that they will use your machine in some way that would harm you?

There are multiple attack vectors I can think of, although most can be mitigated using other security measures. I don't want to rely on audits only off course. To give you an example: using the WordPress environment as a stepping stone to gain more access, running client-side software without out permission (stealing data from visitors, our resources e.g. crypto miners), defacement/fake-news, etc.

My reply to this would be that this is very broad.

In my experience, if you really want to make your infrastructure more secure, you need to explicitely define what it is you want to avoid.

Taking your first point: You say "using the WordPress environment as a stepping stone to gain more access". What type of stepping stone would this be? How can malicious JS on the WP instance escalate its privileges?

Re: Ask HN: How do you security-audit external software using NPM packages?

#38

Post by niros_valtos »

laurent92 wrote: post #8

I use `npm audit` and (and maven-dependency-check) and I trust that vulnerabilities discovered by others are enough. I assume that if I were a sensitive institution, I would pay people to inspect those dependencies and discover vulnerabilities. The medium term would be to publish a bug bounty, so researchers are incentivized to find vulnerabilities.

Opening a bug bounty program where security is immature may cost too much money. If issues won’t be handled in a good enough pace, researchers may stop submitting bounties.

Re: Ask HN: How do you security-audit external software using NPM packages?

#39

Post by niros_valtos »

In terms of preventative measures, harden the underlying infrastructure. For example: prevent outbound connection initiations. If you need it, profile the connections and lock them down.

From a detection standpoint, the free options are NPM audit and GitHub’s Dependabot, which are ok. A commercial option (e.g. Snyk, WhiteSource, BlackDuck) is typically more recommended to manage exceptions and get more accurate results (e.g. is the vulnerable code used by your code).

Re: Ask HN: How do you security-audit external software using NPM packages?

#40

Post by mellavora »

apples_oranges wrote: post #21
TekMol wrote: post #3

Independent of the language, I only use external code if it is small enough that I can manually review it. Often I refactor it into a single file during this process. This of course excludes the majority of packages out there. But apart from security, it has another benefit: These dependency very rarely break and need updates. So compared to projects with a more complex stack, projects with a lean stack are easier to…

Refactoring into a single file sounds like a bit of a pain, since you have to do it every time the external code gets updated. Also how do you deal with dependencies that come with their own dependencies? Do you avoid them?

not necessarily. Depends why the external code was updated and if you need the new functionality.

I'm assuming it isn't a security flaw, because ideally you would have fixed that already during your refactor.

Post reply on HN