Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you security-audit external software using NPM packages?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 85 posts

Re: Ask HN: How do you security-audit external software using NPM packages?

#51

Post by dgb23 »

jhugo wrote: post #31

As much as the JS ecosystem terrifies me, Node isn't really the problem here. Receiving plugins that contain minified blobs of JS is, practically, quite equivalent to receiving plugins that contain binary blobs. If you accept receiving and using plugins that contain unauditable blobs of software, whether it's minified JS or a binary, a good-quality audit is going to be virtually impossible. In many other ecosystems t…

One of the big tradeoffs with Wordpress is that it is a user-first, developer-second kind of framework. I say framework because that is what it has become, for better or worse.

Despite that, developers are building serious/complex websites with tons of custom functionality with WP, by extending it via the hooks that the theme and plugin system provide.

One of many problems with the above is that your whole default project structure is optimized for user workflows rather than developer workflows. Dependency management becomes even more complicated and fragile than it already is. So in terms of JS inclusions you get pre-compiled stuff instead of the source, because WP doesn't have a dependency and build system.

The best strategy to solve that is to _avoid_ dependencies, _especially_ plugins-level dependencies, like hell and have only a minimal vetted list of those. Most functionality plugins provide are again, optimized for users who will only ever touch the GUI and are typically completely unnecessary, too complex and are often painful to interact at the code level.

Plus as a kind of important aside: there is another issue with providing plugins with pre-compiled JS and other stuff without the source. I'm pretty sure it violates the GPL license[0] to do so or is at least a grey area. Would be happy to hear of more knowledgeable people about this issue.

TL;DR: When developing with WP, avoid dependencies and especially plugins. There is already enough accidental complexity as is.

[0] https://developer.wordpress.org/themes/getting-started/wordp...

Re: Ask HN: How do you security-audit external software using NPM packages?

#52

Post by dgb23 »

aww_dang wrote: post #20
roofwellhams wrote: post #16

Earlier quoted context omitted.

If you don't use node, what do you use? You will have the exact same problems if you want to use a library.

For js libraries, I generally prefer something that offers a prebuilt package. If I need to use NPM just to include a Javascript file on a webpage, I generally look elsewhere. Same with CSS themes. For command line tools and packages that require Node, again I generally look elsewhere. Dealing with a rest API on a command line shouldn't require so much bloat. If a tool requires Node as part of a build script, I avoid…

What would you rather download assuming you don't know if you can trust the author: The source files of a program or a distributed binary?

Re: Ask HN: How do you security-audit external software using NPM packages?

#53

Post by dd82 »

TekMol wrote: post #3

Independent of the language, I only use external code if it is small enough that I can manually review it. Often I refactor it into a single file during this process. This of course excludes the majority of packages out there. But apart from security, it has another benefit: These dependency very rarely break and need updates. So compared to projects with a more complex stack, projects with a lean stack are easier to…

>It would be great if there was a "single small file packages" movement so that more lean open source software will be created.

uh, no. what would be even better if TC39 did something beyond window dressing and JS gets a sane standard API so these idiotic requirements for API fill in are no longer required.

These packages are required solely because JS has a crappy API and a vacuum was filled. This increases the surface for supply chain attacks, a la ua-parser-js in Oct.

Other languages have their own issues. But they also have saner stdlibs so the attack vectors are different.

Re: Ask HN: How do you security-audit external software using NPM packages?

#54

Post by tailspin2019 »

tdrdt wrote: post #46

I believe one thing that can help security a little is to use full version numbers in your dependency list. This applies to all package managers. Because the moment someone hits update on the package manager nothing will get updated and you won't receive potential dangerous updates you did not review first. Edit: sorry this is not relevant to the question...

> sorry this is not relevant to the question...

It’s a very good tip though. I must start doing this.

Re: Ask HN: How do you security-audit external software using NPM packages?

#55

Post by TecoAndJix »

allendoerfer wrote: post #36
thih9 wrote: post #7

Earlier quoted context omitted.

Does it recognize hashes of proprietary (closed source, minified) files too?

Nope, it does not. If you remove the comment at the beginning of an unminified JS file, it will not recognize it as outdated anymore. You should treat WhiteSource as something that can potentially help to find problems, but it will by no means grant you security on its own. It is an enterprise tool to help people check boxes.

We leverage it mainly to confirm license compliance but the package vuln notifications are nice

Re: Ask HN: How do you security-audit external software using NPM packages?

#57

Post by raesene9 »

duckmysick wrote: post #34
bjpirt wrote: post #22

We've been using trivy [1] to audit the container builds we've been producing for a relatively security focussed project. As well as scanning for OS package level vulnerabilities it also scans for reported vulnerabilities in NPM packages. Works well for us. But the other complementary approach is to lock down other things - so for example, if you're running in a container, make sure that container can only talk to th…

> make sure that container can only talk to the proxy in front of it Is there a tool like trivy that can help with that?

If you're deploying containers in Kubernetes, that's what network policy will do for you :)

Re: Ask HN: How do you security-audit external software using NPM packages?

#58

Post by dncornholio »

m0zg wrote: post #15

In practice, I don't think anyone bothers. I asked a Node developer how they ensure none of their 3000+ NPM packages would send our customers' confidential information to Somalia, and he looked at me like I'm from another planet. To me that's reason enough to not touch something like this with a hundred foot pole, and keep well away from the blast radius when this inevitably backfires.

How is this different from any other programming language that has dependencies?

Re: Ask HN: How do you security-audit external software using NPM packages?

#59

Post by richardwhiuk »

tdrdt wrote: post #46

I believe one thing that can help security a little is to use full version numbers in your dependency list. This applies to all package managers. Because the moment someone hits update on the package manager nothing will get updated and you won't receive potential dangerous updates you did not review first. Edit: sorry this is not relevant to the question...

You want to have a file specifying your dependencies, and a file specifying your currently locked set - e.g. Cargo.toml and Cargo.lock, or Gemfile and Gemfile.lock, or pyproject.toml and poetry.lock

You'll then want tooling to periodically update your locked dependencies, so that you pick up fixes to security vulnerabilties. That wants to go through your CI.

Re: Ask HN: How do you security-audit external software using NPM packages?

#60

Post by PeterisP »

TekMol wrote: post #18
andris9 wrote: post #14

Earlier quoted context omitted.

npm with wordpress usually means front-end code, so one possible issue is attackers sneaking in stuff like credit card number stealing scripts etc. So it is more like protecting end users and less protecting the server/system.

The security concept behind credit cards is insane. Who thinks that a number which you hand over to everyone you buy from is a secret? Shouldn't this be fixed at the root by handling payments via PayPal or Crypto?

It would have similar security risks if your frontend is compromised, for example, it could make the users pay their cryptocurrency payments to an attacker-controlled address.
Post reply on HN