What could be the npm package the author of this article is referring to?
The article is fictional - but designed to sound plausible in order to make web developers think about a problem.
Harvesting credit card numbers and passwords from websites
11–20 of 128 posts
Re: Harvesting credit card numbers and passwords from websites
#12What could be the npm package the author of this article is referring to?
"This post is entirely fictional, but altogether plausible, and I hope at least a little educational.
Although this is all made up, it worries me that none of this is hard."
Re: Harvesting credit card numbers and passwords from websites
#13One of the biggest problems here is that there is no “chain of custody” from Github source to uploaded NPM module; otherwise one of the developers using the malicious package could have audited the source code before including it in their own code. ‘npm publish’ would ideally insist on reproducible builds, enforce this by minifying or compiling packages itself, and finally encourage the community to always audit the code associated with a module. Of course, people are lazy, NPM has no incentive to incur that server and engineering overhead, and someone could sneak in code anyways with a minor version update... There’s no clear solution here, and I think the only thing keeping up this house of cards is that there are much easier ways for black hats to make money.
Re: Harvesting credit card numbers and passwords from websites
#14> Our penetration testers would see it in their HTTP request monitoring tools!
> What hours do they work? My code doesn’t send anything between 7am and 7pm.
Which Time Zone? Hah!
(Not that this one nit pick takes away from the general very well made point of the article, I just love how TimeZone problems infect everything)
Re: Harvesting credit card numbers and passwords from websites
#15One of the biggest problems here is that there is no “chain of custody” from Github source to uploaded NPM module; otherwise one of the developers using the malicious package could have audited the source code before including it in their own code. ‘npm publish’ would ideally insist on reproducible builds, enforce this by minifying or compiling packages itself, and finally encourage the community to always audit the…
Even if you had that, no one is going to inspect all that code. npm is a cluster-farkle of insane amounts of packages.
The whole point of the article is you should implement CSP.
Re: Harvesting credit card numbers and passwords from websites
#16Couldn't one circumvent CSP by sending the data to a legitimate analytics service that everyone uses like Google Analytics?
Re: Harvesting credit card numbers and passwords from websites
#17> Our penetration testers would see it in their HTTP request monitoring tools! > What hours do they work? My code doesn’t send anything between 7am and 7pm. Which Time Zone? Hah! (Not that this one nit pick takes away from the general very well made point of the article, I just love how TimeZone problems infect everything )
The browser’s? People do tend to keep their PC in the local timezone.
Re: Harvesting credit card numbers and passwords from websites
#18This is a problem for the PHP composer ecosystem as well. I took a look at how many vendor packages our core has and its about 20...
Re: Harvesting credit card numbers and passwords from websites
#19> Our penetration testers would see it in their HTTP request monitoring tools! > What hours do they work? My code doesn’t send anything between 7am and 7pm. Which Time Zone? Hah! (Not that this one nit pick takes away from the general very well made point of the article, I just love how TimeZone problems infect everything )
It's client-side code. So the browser's time zone.
Re: Harvesting credit card numbers and passwords from websites
#20Well-written, educational, incites action. Thank you.