Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious crossenv package on npm

twitter.com

Post reply on HN
Print view View original

81–90 of 237 posts

Re: Malicious crossenv package on npm

#81

Post by fiatjaf »

This is issue is not so hard to deal with.

1. For every big, important package, you can probably count on number of downloads/stars a library has to attest its trustworthiness.

2. For small packages, you should always look at the code directly. Search npm, see the GitHub repository link, click, read the source to see if it more-or-less does what you want. I think a lot of people do this already.

3. Typosquatting is still the only unsolved problem, but an addition to the npm CLI that checks if there are packages with similar names when you're downloading and alerts you -- maybe even suggesting the package that has much more downloads/stars -- should solve that.

Re: Malicious crossenv package on npm

#82

Post by pfooti »

danjoc wrote: post #73
detaro wrote: post #58

Earlier quoted context omitted.

How does "You need my private key to sign the cross-env package" stop someone from creating a "crossenv" package? What does the specific workflow look like that makes sure I don't add the wrong thing to my project?

I can explain how it can be done. Let's say you need a new dependency. You can't just add it to the project. Management would kill you. There's a lot of checks you have to make. Like licenses and signatures. In this case, you're concerned about signatures. I'll stick to that. If I believe I need crossenv, I see it advertises kent@doddsfamily.com as the author. I look up Kent Dodds. I find various bits of information…

Why would the malicious user advertise the email associated with crossenv as kent@doddsfamily.com and not kent@dodds.family? Attacker could control the latter and hand you an evil cert?

Re: Malicious crossenv package on npm

#83

Post by KirinDave »

_jal wrote: post #80
KirinDave wrote: post #69

Earlier quoted context omitted.

What's to be done is remove the package and try and dox the perpetrator to kingdom come, in hopes that law enforcement and social reputation can make an example of of them.

That method does not scale. Additionally, it assumes that members of law enforcement are not publishing malware.

I assure you my malice scales infinitely.

Re: Malicious crossenv package on npm

#84

Post by _jal »

koolba wrote: post #54
danjoc wrote: post #50

Earlier quoted context omitted.

The signature might validate, but at the point you go to Kent C Dobbs to verify he controls the key, the ruse is uncovered.

And nobody but the most tinfoily of us is going to do that. So short of a web of trust or delegation, you get nothing more than a checksum.

Saying you won't use the tools we have because we don't have something better is choosing to accept a greater risk of running dangerous code than you have to. Which is your choice, of course. But one best made with clear eyes.

Re: Malicious crossenv package on npm

#85

Post by jsjohnst »

KirinDave wrote: post #69
chii wrote: post #66

Earlier quoted context omitted.

It doesn't. They's not the problem being solved by signing. In all likelihood, if an end user got socially engineered to download the wrong package, there's very little to be done. Perhaps the install process can do a search and display similarly named packages, and the users could be more alert to irregularly named ones?

What's to be done is remove the package and try and dox the perpetrator to kingdom come, in hopes that law enforcement and social reputation can make an example of of them.

You should've stopped at the first "and". Advocating for vigilante justice helps solve no problems.

Re: Malicious crossenv package on npm

#86

Post by koolba »

danjoc wrote: post #60
koolba wrote: post #54

Earlier quoted context omitted.

And nobody but the most tinfoily of us is going to do that. So short of a web of trust or delegation, you get nothing more than a checksum.

>nobody but the most tinfoily of us is going to do that Are you characterizing people who verify keys as crazy? It's not like you can't just reach out to @kentcdodds and get an answer in under 5 hours as Oscar Blomsten just did in the OP.

On the contrary. I'd say we're the sane ones (note that I'm part of that crew). I'm just realistic that we're a tiny minority. Most people don't understand the topic or care to do any of that. Most people also blindly copy paste curl scripts into sudo bash.

Re: Malicious crossenv package on npm

#87

Post by [deleted] »

fpgaminer wrote: post #76

Is there an api to query recent NPM packages, as well as get a full list of packages? It'd be interesting to write a tool that monitors as packages are added to npm, compare them against the existing list, and check for potential typo-squatting. Like, remove dashes, check Levenshtein distance, etc. I mean, NPM themselves should be doing that but ... since they aren't, might as well do it for them, ya?

[deleted]

Re: Malicious crossenv package on npm

#88

Post by jonknee »

RandomInteger4 wrote: post #26
doingmyting wrote: post #14

Earlier quoted context omitted.

It's next to impossible for the average team to avoid hundreds of dependencies as their project grows though. You could write your own everything, but then what's the benefit of the node ecosystem? Edit: spelling

How many of those dependancies are trivial though? It's one thing to rewrite express, but something different to rewrite a package that just contains a function that capitalizes the first letter of a string or something similarly contrived, yet plausibly already a package.

That's the argument behind a stdlib of sorts for npm with blessed packages that are actively maintained and signed. Having every project rely on tons of dependencies isn't great, but re-writing everything a bunch of times also isn't great. There are bound to be bugs within 100 different implementations of X.

It is certainly out of control though. I just checked the node_modules of a fresh create-react-app generated app and there are 877 packages! Tons of duplication here, like having both array-uniq and array-unique (not to mention that's a feature built into languages like Python).

Re: Malicious crossenv package on npm

#90

Post by arca_vorago »

danjoc wrote: post #31

Friendly reminder, every time this happens... https://github.com/npm/npm/pull/4016 "However, this is just a piece of an overall solution, and it brings with it a lot of the baggage that comes along whenever GnuPG or PGP get involved. Without a web of trust (sigh), a PKI (ugh), or some other mechanism to tie identities to trust metrics, this is essentially a complicated, very expensive, and fragile version of the shas…

I think this is a problem with the "fad" approach to dev. As a sysadmin I try to stay on top of tech at a 50k ft view, so when node and angular and MEAN stack started showing up everywhere, I tried my hand a bit, and walked away remembering how much I hated the javascript ecosystem that existed before these things, and how the community seemed to be younger, newer devs trying something shiny and repeating fuckups that had already been through other langs/environments. Security for these kinds of devs is not even an afterthought, it's someone elses problem.
Post reply on HN