Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious crossenv package on npm

twitter.com

Post reply on HN
Print view View original

201–210 of 237 posts

Re: Malicious crossenv package on npm

#201

Post by KirinDave »

tomc1985 wrote: post #139
KirinDave wrote: post #77

Earlier quoted context omitted.

Hashes already exist. The problem is not a lack of integrity verification. We have that. The problem is not a lack of identity verification, we haven't really shown that NPM is lacking for that. The problem is one of addressing. People want to get packages by a utf8 and natural language string, followed by a version boundary check. If people referred to packages by their proper hash (as one does when referencing valu…

Yeah I'm not really following how users desiring a natural-language tuple-looking thing prevents proper identity verification. Even without namespacing strong identity controls (signature verification and preventing unauthorized accounts from posting under a taken name, for example) can prevent most attacks short of typosquatting.

You seem to have a handle on every aspect of this situation except what the actual attack we're discussing was.

It was typo squatting.

Re: Malicious crossenv package on npm

#202

Post by KirinDave »

unkown-unknowns wrote: post #164
KirinDave wrote: post #127

Earlier quoted context omitted.

If you connect to my resources and use my systems to hurt other people, you don't really have an ethical leg to stand on if I share what details about you I have with law enforcement and other service providers. It's absolutely an attack, but it's an "attack" of a kind that is acting to end misuse and widespread tampering. It's difficult to imagine a coherent ethical system that gives the author of malicious software…

Like sibling says, doxxing implies that you'll post their personal info online. The problem does not lie in attacking bad people, the problem is that there is a high risk that you THINK you've identified who the bad actor is but actually the person you decide to "retaliate" against had nothing to do with what was done to you. That's why we leave law enforcement to the law enforcement officials and justice to the just…

> Like sibling says, doxxing implies that you'll post their personal info online.

It's unfortunate that so many people don't know what the word means, because now we're redefining the word to a very specific and malicious definition that makes communication about nuances around the intersection of rights here more difficult.

> there is a high risk that you THINK you've identified who the bad actor is but actually the person you decide to "retaliate" against had nothing to do with what was done to you.

I mean, you'll know their IP address, login, email, ISP and whatnot at a minimum. If the target is a comprimised computer, notifying them is the bare minimum you should do. So I'm sort of confused what kind of final consequence you're imagining here.

I think folks just see the word "doxxing" and their pattern matching misfires.

Re: Malicious crossenv package on npm

#203

Post by KirinDave »

skywhopper wrote: post #67
slackingoff2017 wrote: post #56

Earlier quoted context omitted.

Maven does not have this problem. That package was just something you googled that hasn't been updated in two years because maven has required signed packages forever. My packages are all cryptographically signed with my private key. Maven doesn't just offer code signing, it's mandatory to deploy projects to the central repo. The automated package verifier will reject you if you don't have it. If someone gains access…

I'm guessing maven feels safer because its packages must be compiled against a specific interface and few if any execute any code during setup. Maven is rarely if ever used to install interactive tools like npm very often is. Maven is not a reasonable analog here.

People keep saying this, but it's easy to imagine that the malicious code in a maven-included package only works when it detects it's being invoked in a unit test, which puts it in build time easily.

It's true it doesn't immediately build on site, but it sure could run in the developer's machine.

Re: Malicious crossenv package on npm

#204

Post by johncomposed »

fiatjaf wrote: post #96
Klathmon wrote: post #94

Earlier quoted context omitted.

Or package authors should start using scoped packages. Instead of publishing as cross-env you publish as @guy/cross-env That makes typosquatting harder, and can help give users some ideas of packages which are by the same authors. NPM could help by allowing packages to be published both to the "global namespace" AND as a scoped package automatically. (In other words, always allow accessing any global package by it's…

Yes, I like that idea. I would rather have some GitHub integration in place, so I could `npm install github.com/someone/somepackage`, like Golang forces us to do, for example. I don't do that for all packages automatically nowadays because there is this bizarre culture of people publishing different things to npm and GitHub. To npm they send only "built" files from ES7 to ES5-compatible mode, while to GitHub go only…

Npm has had github integration for a while now (and straight git integration). Depending on how they setup things, a repo with a good postinstall script will build once it gets pulled so you'll have ES5 compatible files in your node_modules by the time you are running your application.

Not that that's an ideal system, but it's an option for some packages.

Re: Malicious crossenv package on npm

#205

Post by sloppycee »

KirinDave wrote: post #200
camus2 wrote: post #173

Earlier quoted context omitted.

> Well npm requires you to login through their CLI in order to publish packages... The only difference is that you use a password instead of a key. No difference. Yes, there is a difference, released must be digitally signed on maven. They are not on NPM, so a hacker can hijack your packages just by obtaining your npm credentials. That's crypto 101 and you can't tell the difference?

> so a hacker can hijack your packages just by obtaining your npm credentials. Couldn't they 'just' steal your GPG key as well? If someone can trivially steal a strong password from you, I'd worry about key material as well. > That's crypto 101 and you can't tell the difference? Please reconsider sentences like these.

The issue is of who to trust, the package maintainer or the package repository?

It is comparatively trivial to steal a strong password when it is transmitted over the internet vs local key material.

Nation states with bad certs (china has done this) can steal your password, npm can steal your password, npm can be hacked and leak passwords, npm can be subject to a NSL and forced to hand over passwords, etc, etc.

There is a big difference between passwords and keys.

Re: Malicious crossenv package on npm

#206

Post by KirinDave »

lmm wrote: post #181
KirinDave wrote: post #77

Earlier quoted context omitted.

Hashes already exist. The problem is not a lack of integrity verification. We have that. The problem is not a lack of identity verification, we haven't really shown that NPM is lacking for that. The problem is one of addressing. People want to get packages by a utf8 and natural language string, followed by a version boundary check. If people referred to packages by their proper hash (as one does when referencing valu…

> If people referred to packages by their proper hash (as one does when referencing values from IPFS), then we wouldn't have this problem. If people had a public key and added a key fingerprint that would also work, but would not provide any additional verification to the code (1). The hash naturally changes with every release. The key fingerprint doesn't. Updating your dependencies to new releases is much, much more…

I don't understand why you feel that the keybase question was directed at you. The decision to enter into this part of the discussion definitely hurt otherwise interesting post.

It's true that a signature is based around a component with longer lifespan than a hash. However the management and trust of that component damages this argument severely.

I am unaware of any web of trust in active use that could operate a npm scale existing today. Could you share one with me?

Re: Malicious crossenv package on npm

#207

Post by jsjohnst »

KirinDave wrote: post #202
unkown-unknowns wrote: post #164

Earlier quoted context omitted.

Like sibling says, doxxing implies that you'll post their personal info online. The problem does not lie in attacking bad people, the problem is that there is a high risk that you THINK you've identified who the bad actor is but actually the person you decide to "retaliate" against had nothing to do with what was done to you. That's why we leave law enforcement to the law enforcement officials and justice to the just…

> Like sibling says, doxxing implies that you'll post their personal info online. It's unfortunate that so many people don't know what the word means, because now we're redefining the word to a very specific and malicious definition that makes communication about nuances around the intersection of rights here more difficult. > there is a high risk that you THINK you've identified who the bad actor is but actually the…

> I think folks just see the word "doxxing" and their pattern matching misfires.

Or maybe you're trying to weasel out of what you said and are now going for broke.

Linking once again to define words, we go to Wikipedia[0]:

> Doxing is the Internet-based practice of researching and broadcasting private or identifiable information

> Doxing may be carried out for various reasons, including to aid law enforcement, business analysis, extortion, coercion, harassment, online shaming, AND VIGILANTE JUSTICE.

(Emphasis mine)

[0] https://en.m.wikipedia.org/wiki/Doxing

Re: Malicious crossenv package on npm

#208

Post by omg_ketchup »

pfooti wrote: post #71
danjoc wrote: post #60

Earlier quoted context omitted.

>nobody but the most tinfoily of us is going to do that Are you characterizing people who verify keys as crazy? It's not like you can't just reach out to @kentcdodds and get an answer in under 5 hours as Oscar Blomsten just did in the OP.

I'm working on a node-based REST endpoint. It's nothing special - it looks up stuff in the database, does CRUD things, pokes postgres, has a cache layer in redis, a websocket for handling sidechannel stuff like model update events for realtime data updates and so on. It has 514 dependencies in total. It's actually only 39 real dependencies, the rest are subs and sub-subs (after removing duplicates). Also, some of tho…

What if someone just maintained a list of "bad" npm packages, and you could run your package.json against that service to make sure you didn't accidentally install crossenv instead of cross-env?

Re: Malicious crossenv package on npm

#209

Post by tim333 »

lathiat wrote: post #103

Just yesterday there was a thread about how the chrome plugin "user agent switcher" sends your entire browsing history externally. And it's still published. The problem is not unique to the npm ecosystem, the main problem here is "web of trust" whether through GPG or even just things like 'download counts', etc.

Also there are at least three chrome extensions in the store called "user agent switcher" which confuses matters. From useragentswitcher.org, google.com and toolshack.com

Re: Malicious crossenv package on npm

#210

Post by KirinDave »

jsjohnst wrote: post #207
KirinDave wrote: post #202

Earlier quoted context omitted.

> Like sibling says, doxxing implies that you'll post their personal info online. It's unfortunate that so many people don't know what the word means, because now we're redefining the word to a very specific and malicious definition that makes communication about nuances around the intersection of rights here more difficult. > there is a high risk that you THINK you've identified who the bad actor is but actually the…

> I think folks just see the word "doxxing" and their pattern matching misfires. Or maybe you're trying to weasel out of what you said and are now going for broke. Linking once again to define words, we go to Wikipedia[0]: > Doxing is the Internet-based practice of researching and broadcasting private or identifiable information > Doxing may be carried out for various reasons, including to aid law enforcement, busine…

"Weasel?"

I can see this is going to be a constructive dialogue. If I had wanted to "weasel" I would have deleted the post last night when it passed under the negative point threshold.

I have absolutely 0 moral and ethical problems with publishing any details I have on a person who is using my system to attack other users. I think in fact this is a responsible thing to do, and necessary. In this specific case, I might be careful about the timing of the disclosure to try and round up any nasty packages in other systems they might have generated.

But I'd publish it. Happily. Gleefully even. I have 0 moral or ethical obligations not to. I have a clear ethical imperative to do so.

I guess fortunately for this scammer, I don't own NPM.

Post reply on HN