Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Half of all JavaScript npm packages could have been hacked via weak credentials

bleepingcomputer.com

Post reply on HN
Print view View original

31–38 of 38 posts

Re: Half of all JavaScript npm packages could have been hacked via weak credentials

#32

Post by gsich »

robocat wrote: post #8

The npm ecosystem is fundamentally insecure. Some highlights: * I obtained accounts of 4 users from the top-20 list. * One of those 4 users set their password back to the leaked one shortly after it was reset. * 13 users [that I found the password for] had more than 50 million downloads/month. * One of the users directly controlling more than 20 million downloads/month chose to improve their previously revoked leaked…

What do you expect? The userbase requires stuff like isinteger and left-pad as packages, I don't think they are capable of understanding basic security concepts. On another note, NPM is rooting for companies instead of users as has been observed by the leftpad debacle.

Re: Half of all JavaScript npm packages could have been hacked via weak credentials

#33

Post by peterwwillis »

jclulow wrote: post #7
peterwwillis wrote: post #5

So, why is it they're not using certificates?

I can imagine this would lead to a rash of certificates committed to repositories on GitHub.

My bad - I said certificates when I meant public key crypto. They would only check in a public key.

Re: Half of all JavaScript npm packages could have been hacked via weak credentials

#35

Post by dang »

flavio81 wrote: post #34

Obligatory HN reminder that the NPM system is crap and you shouldn't be using it.

Please don't post like this; it breaks the site guidelines and discredits both your point and you.

https://news.ycombinator.com/newsguidelines.html

This applies regardless of whether your underlying view is correct.

Re: Half of all JavaScript npm packages could have been hacked via weak credentials

#36

Post by bonestamp2 »

hayksaakian wrote: post #11
epicide wrote: post #10

Earlier quoted context omitted.

I don't see how any of these reasons are why npm is "fundamentally insecure" any more than any other system involving humans.

maybe there should be some type of 2 factor authorization to make sure you can't get in by guessing someone's insecure password, or grabbing it from a leak (due to password reuse).

Requiring it would be wise, or at least requiring it if any other packages depend on it. They're going to destroy the ecosystem if they can't secure it. One major blow and nobody will trust it anymore.

Re: Half of all JavaScript npm packages could have been hacked via weak credentials

#37

Post by flavio81 »

dang wrote: post #35
flavio81 wrote: post #34

Obligatory HN reminder that the NPM system is crap and you shouldn't be using it.

Please don't post like this; it breaks the site guidelines and discredits both your point and you. https://news.ycombinator.com/newsguidelines.html This applies regardless of whether your underlying view is correct.

I'm sorry.

I should have said that NPM is fundamentally and essentially flawed, and that HN readers should not use it, favoring alternatives like Yarn instead.

Re: Half of all JavaScript npm packages could have been hacked via weak credentials

#38

Post by dbrgn »

flavio81 wrote: post #37
dang wrote: post #35

Earlier quoted context omitted.

Please don't post like this; it breaks the site guidelines and discredits both your point and you. https://news.ycombinator.com/newsguidelines.html This applies regardless of whether your underlying view is correct.

I'm sorry. I should have said that NPM is fundamentally and essentially flawed, and that HN readers should not use it, favoring alternatives like Yarn instead.

Isn't yarn also accessing npm repos? Also, in 99.9% of the cases yarn is installed through npm.
Post reply on HN