Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious crossenv package on npm

twitter.com

Post reply on HN
Print view View original

41–50 of 237 posts

Re: Malicious crossenv package on npm

#41

Post by iamakulov »

danjoc wrote: post #31

Friendly reminder, every time this happens... https://github.com/npm/npm/pull/4016 "However, this is just a piece of an overall solution, and it brings with it a lot of the baggage that comes along whenever GnuPG or PGP get involved. Without a web of trust (sigh), a PKI (ugh), or some other mechanism to tie identities to trust metrics, this is essentially a complicated, very expensive, and fragile version of the shas…

npm is working on a solution for misspellings through: https://twitter.com/maybekatz/status/892501201551368192

Re: Malicious crossenv package on npm

#42

Post by KirinDave »

danjoc wrote: post #31

Friendly reminder, every time this happens... https://github.com/npm/npm/pull/4016 "However, this is just a piece of an overall solution, and it brings with it a lot of the baggage that comes along whenever GnuPG or PGP get involved. Without a web of trust (sigh), a PKI (ugh), or some other mechanism to tie identities to trust metrics, this is essentially a complicated, very expensive, and fragile version of the shas…

> I really like how the NPM simultaneously insults two legends in crypto and does _nothing_ to protect the node ecosystem, deferring to "better solutions" that don't exist and will never exist.

But they're right. What exactly would PKI do here? Someone is generating confusion.

You could argue that maybe a PKI solution could be used to inform the UI such that users are less likely to make mistakes, but browbeating NPM over this is silly. Maven has this problem (people really concerned built their own tools: https://github.com/whispersystems/gradle-witness), choclatey has this problem, pip has this problem, everyone has this problem.

The big difference is that the NPM ecosystem is just an order of magnitude bigger than most others, and its model of many small packages can hide many more key packages in the noise.

Re: Malicious crossenv package on npm

#43

Post by KirinDave »

stu_k wrote: post #40
danjoc wrote: post #31

Friendly reminder, every time this happens... https://github.com/npm/npm/pull/4016 "However, this is just a piece of an overall solution, and it brings with it a lot of the baggage that comes along whenever GnuPG or PGP get involved. Without a web of trust (sigh), a PKI (ugh), or some other mechanism to tie identities to trust metrics, this is essentially a complicated, very expensive, and fragile version of the shas…

I'm confused, how would the above help with a typosquatting package? The issue here is that `crossenv` is malicious, and `cross-env` isn't. The signatures would all be ok in both cases.

It wouldn't. People look for any opportunity they can muster to browbeat the node community. Probably because they're jealous of its outsized success.

Re: Malicious crossenv package on npm

#44

Post by TAForObvReasons »

jjnoakes wrote: post #30
doingmyting wrote: post #14

Earlier quoted context omitted.

It's next to impossible for the average team to avoid hundreds of dependencies as their project grows though. You could write your own everything, but then what's the benefit of the node ecosystem? Edit: spelling

I wish the node ecosystem would learn from more mature ones. I would like to see a curated set of popular libraries that are stabilized and blessed, and a core group that handles security updates and upgrading packages in the blessed set.

There are attempts like https://nodesource.com/products/certified-modules but do you trust the ratings if they don't have control over those modules?

Re: Malicious crossenv package on npm

#45

Post by danjoc »

KirinDave wrote: post #42
danjoc wrote: post #31

Friendly reminder, every time this happens... https://github.com/npm/npm/pull/4016 "However, this is just a piece of an overall solution, and it brings with it a lot of the baggage that comes along whenever GnuPG or PGP get involved. Without a web of trust (sigh), a PKI (ugh), or some other mechanism to tie identities to trust metrics, this is essentially a complicated, very expensive, and fragile version of the shas…

> I really like how the NPM simultaneously insults two legends in crypto and does _nothing_ to protect the node ecosystem, deferring to "better solutions" that don't exist and will never exist. But they're right. What exactly would PKI do here? Someone is generating confusion. You could argue that maybe a PKI solution could be used to inform the UI such that users are less likely to make mistakes, but browbeating NPM…

>Maven has this problem

What malicious packages have been found on Maven central?

Re: Malicious crossenv package on npm

#46

Post by KirinDave »

danjoc wrote: post #45
KirinDave wrote: post #42

Earlier quoted context omitted.

> I really like how the NPM simultaneously insults two legends in crypto and does _nothing_ to protect the node ecosystem, deferring to "better solutions" that don't exist and will never exist. But they're right. What exactly would PKI do here? Someone is generating confusion. You could argue that maybe a PKI solution could be used to inform the UI such that users are less likely to make mistakes, but browbeating NPM…

>Maven has this problem What malicious packages have been found on Maven central?

Why don't you google or follow the link I already gave?

Re: Malicious crossenv package on npm

#47

Post by danjoc »

KirinDave wrote: post #46
danjoc wrote: post #45

Earlier quoted context omitted.

>Maven has this problem What malicious packages have been found on Maven central?

Why don't you google or follow the link I already gave?

Exactly what I thought. You can't name one. Coincidentally, Maven central requires GPG signatures.

Re: Malicious crossenv package on npm

#48

Post by KirinDave »

danjoc wrote: post #47
KirinDave wrote: post #46

Earlier quoted context omitted.

Why don't you google or follow the link I already gave?

Exactly what I thought. You can't name one. Coincidentally, Maven central requires GPG signatures.

As we all know you can only sign a piece of code if it is free of malicious software.

Heck, I read that you can't even make a GPG key without proving your virtue to Richard Stallman in festivus-style competition.

Re: Malicious crossenv package on npm

#49

Post by Splines »

codefined wrote: post #3
eropple wrote: post #2

This is important. It looks like the organization is submerging; they've deleted their NPM account and the package and emptied their GitHub repo. This should be signal boosted as hard as it can be managed, because this is rough stuff.

What can be done to help sort problems like this?

Not a js dev, but it seems like when doing a compare if a package already exists, hyphens should be removed (so "crossenv" and "cross-env" are considered identical). "js" seems like needless verbosity, maybe take that out too.

I wouldn't doubt that there are package names that would collide because of such a change, but that's probably a good thing.

Does npm normalize package names with unicode in them? Would "сrοѕѕ-еnν" be considered equivalent? (Although this would only work if users copy/paste the name).

Re: Malicious crossenv package on npm

#50

Post by danjoc »

stu_k wrote: post #40
danjoc wrote: post #31

Friendly reminder, every time this happens... https://github.com/npm/npm/pull/4016 "However, this is just a piece of an overall solution, and it brings with it a lot of the baggage that comes along whenever GnuPG or PGP get involved. Without a web of trust (sigh), a PKI (ugh), or some other mechanism to tie identities to trust metrics, this is essentially a complicated, very expensive, and fragile version of the shas…

I'm confused, how would the above help with a typosquatting package? The issue here is that `crossenv` is malicious, and `cross-env` isn't. The signatures would all be ok in both cases.

The signature might validate, but at the point you go to Kent C Dobbs to verify he controls the key, the ruse is uncovered.
Post reply on HN