Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious crossenv package on npm

twitter.com

Post reply on HN
Print view View original

101–110 of 237 posts

Re: Malicious crossenv package on npm

#101

Post by pfooti »

danjoc wrote: post #73
detaro wrote: post #58

Earlier quoted context omitted.

How does "You need my private key to sign the cross-env package" stop someone from creating a "crossenv" package? What does the specific workflow look like that makes sure I don't add the wrong thing to my project?

I can explain how it can be done. Let's say you need a new dependency. You can't just add it to the project. Management would kill you. There's a lot of checks you have to make. Like licenses and signatures. In this case, you're concerned about signatures. I'll stick to that. If I believe I need crossenv, I see it advertises kent@doddsfamily.com as the author. I look up Kent Dodds. I find various bits of information…

One of the central problems of trust is that simple solutions don't scale well. Back in the day, one acquired a .com address by sending someone an email, because everyone knew everyone.

cross-env has had 1.3 million downloads in the last month. How many of those "hey, I am evaluating your library" emails can Dodds field?

Most node projects have hundreds of dependencies, if you include transitive dependencies. How many of those can you test?

If simple solutions worked, they'd be used.

Re: Malicious crossenv package on npm

#102

Post by pcwalton »

Klathmon wrote: post #94
fiatjaf wrote: post #81

This is issue is not so hard to deal with. 1. For every big, important package, you can probably count on number of downloads/stars a library has to attest its trustworthiness. 2. For small packages, you should always look at the code directly. Search npm, see the GitHub repository link, click, read the source to see if it more-or-less does what you want. I think a lot of people do this already. 3. Typosquatting is s…

Or package authors should start using scoped packages. Instead of publishing as cross-env you publish as @guy/cross-env That makes typosquatting harder, and can help give users some ideas of packages which are by the same authors. NPM could help by allowing packages to be published both to the "global namespace" AND as a scoped package automatically. (In other words, always allow accessing any global package by it's…

You could still typosquat as e.g. @guyy/cross-env.

Re: Malicious crossenv package on npm

#103

Post by lathiat »

Just yesterday there was a thread about how the chrome plugin "user agent switcher" sends your entire browsing history externally. And it's still published.

The problem is not unique to the npm ecosystem, the main problem here is "web of trust" whether through GPG or even just things like 'download counts', etc.

Re: Malicious crossenv package on npm

#105

Post by hedora »

slackingoff2017 wrote: post #56
KirinDave wrote: post #42

Earlier quoted context omitted.

> I really like how the NPM simultaneously insults two legends in crypto and does _nothing_ to protect the node ecosystem, deferring to "better solutions" that don't exist and will never exist. But they're right. What exactly would PKI do here? Someone is generating confusion. You could argue that maybe a PKI solution could be used to inform the UI such that users are less likely to make mistakes, but browbeating NPM…

Maven does not have this problem. That package was just something you googled that hasn't been updated in two years because maven has required signed packages forever. My packages are all cryptographically signed with my private key. Maven doesn't just offer code signing, it's mandatory to deploy projects to the central repo. The automated package verifier will reject you if you don't have it. If someone gains access…

Does maven really reliably validate packages these days?

I once did a mvn build on a southwest flight and got stuff like "Syntax error: Click here for free TV..." all over my console.

This was ~4 years ago. If I remember right, maven "supported" package validation, but it was certainly not the de facto standard.

Re: Malicious crossenv package on npm

#106

Post by tuananh »

danjoc wrote: post #31

Friendly reminder, every time this happens... https://github.com/npm/npm/pull/4016 "However, this is just a piece of an overall solution, and it brings with it a lot of the baggage that comes along whenever GnuPG or PGP get involved. Without a web of trust (sigh), a PKI (ugh), or some other mechanism to tie identities to trust metrics, this is essentially a complicated, very expensive, and fragile version of the shas…

@danjoc: do you have a reference for this? I'm interested.

> I really like how the NPM simultaneously insults two legends in crypto and does _nothing_ to protect the node ecosystem, deferring to "better solutions" that don't exist and will never exist.

Re: Malicious crossenv package on npm

#107

Post by pfooti »

jjnoakes wrote: post #30
doingmyting wrote: post #14

Earlier quoted context omitted.

It's next to impossible for the average team to avoid hundreds of dependencies as their project grows though. You could write your own everything, but then what's the benefit of the node ecosystem? Edit: spelling

I wish the node ecosystem would learn from more mature ones. I would like to see a curated set of popular libraries that are stabilized and blessed, and a core group that handles security updates and upgrading packages in the blessed set.

who gets paid to support that ecosystem, and who does the paying? as a simple example, I use the hapi.js server framework (because it is awesome). At one point, it was supported by Walmart Labs. It isn't anymore - it's mostly supported by the original author (Eran Hammer), who is getting paid less than $5k per month to develop / support it via patreon (and take a look at the bimodal distribution on his patreon page). And that's just for part of the overall ecosystem.

Part of the excitement of js dev is that there's always really useful libraries being created and distributed (ramda, rxjs, react to just name three things that start with R).

Not sure there is a good solution here - we want tons of value, but I suspect nobody's willing to actually pay for it. Libraries like cross-env, ramda, and so on all are excellent, useful, well-written, and the authors are responsive.

Re: Malicious crossenv package on npm

#108

Post by teknologist »

iamakulov wrote: post #34

For everyone, here’s a one-liner to check your dependency tree: npm ls | grep -E "babelcli|crossenv|cross-env.js|d3.js|fabric-js|ffmepg|gruntcli|http-proxy.js|jquery.js|mariadb|mongose|mssql.js|mssql-node|mysqljs|nodecaffe|nodefabric|node-fabric|nodeffmpeg|nodemailer-js|nodemailer.js|nodemssql|node-opencv|node-opensl|node-openssl|noderequest|nodesass|nodesqlite|node-sqlite|node-tkinter|opencv.js|openssl.js|proxy.js|s…

npm ls is interchangeable with yarn list for those using yarn.

Re: Malicious crossenv package on npm

#109

Post by jsjohnst »

KirinDave wrote: post #100
jsjohnst wrote: post #95

Earlier quoted context omitted.

> dox the perpetrator to kingdom come, in hopes that law enforcement and social reputation can make an example of of them. Is a hell of a lot closer to "vigilante justice" than the version you just said. Had you made the sane posting first (or not pretended you did the second time) I wouldn't have said anything and just upvoted in agreement.

Which part of the statement implied "vilgilate justice." The part with the law enforcement or the "social reputation" part that is exactly the words game theory uses when discussing bad actor in a problem. Just so I can modify my words to avoid future misunderstanding.

> dox the perpetrator to kingdom come

I can't believe it wasn't obvious, but that's the part which implies vigilante justice.

From Wikipedia[0]:

A vigilante is a civilian or organization acting in a law enforcement capacity (or in the pursuit of self-perceived justice) without legal authority.

Doxing has a very specific meaning and it directly implies taking matters into your own hands, aka vigilante.

[0] https://en.m.wikipedia.org/wiki/Vigilante

Re: Malicious crossenv package on npm

#110

Post by water42 »

fpgaminer wrote: post #76

Is there an api to query recent NPM packages, as well as get a full list of packages? It'd be interesting to write a tool that monitors as packages are added to npm, compare them against the existing list, and check for potential typo-squatting. Like, remove dashes, check Levenshtein distance, etc. I mean, NPM themselves should be doing that but ... since they aren't, might as well do it for them, ya?

https://skimdb.npmjs.com/registry/_design/scratch/_view/byFi...

looks like there is an api

Post reply on HN