Live data from Hacker News

Malicious code in the purescript NPM installer

harry.garrood.me

121–130 of 279 posts

Re: Malicious code in the purescript NPM installer

#121

Earlier quoted context omitted.

I’m not a JS developer so maybe I’m missing something, but how do you use a library during development and not use it in production? In the C++ world, I can’t imagine a situation where you would need to depend on, for example, libjpg while developing, but not need to read JPEG files in prod/end-user-space.

In the C++ world, you almost certainly don't need headers in prod.

Yes, true. What’s your point? You still need libjpg to be either statically linked into your executable or present on the target system.

Re: Malicious code in the purescript NPM installer

#122

Earlier quoted context omitted.

But it doesn't work for libraries people will be using in development. Often you are waiting for a handful of packages to introduce specific features or bug fixes and need them the moment they are available. NPM isn't user space, it's dev space. Timeliness is the maxim.

I’m not a JS developer so maybe I’m missing something, but how do you use a library during development and not use it in production? In the C++ world, I can’t imagine a situation where you would need to depend on, for example, libjpg while developing, but not need to read JPEG files in prod/end-user-space.

> I’m not a JS developer so maybe I’m missing something

Yes, you have outdated respect for production quality. JS world is less concerned with such details.

Re: Malicious code in the purescript NPM installer

#123
High-velocity ecosystems like this make it way too easy to optimise your code for getting pats on the head. It's good that people are pointing out things like this (relatively speaking) not long after the fact, and that a lot of people on here are annoyed about it. The fix is cultural as much as any 2FA implementation.

Re: Malicious code in the purescript NPM installer

#124
post #84
post #80

The real issue the Balkanization of JavaScript programs. The `rate-map` package is essentially one line of code: start + val * (end - start); https://github.com/shinnn/rate-map/blob/90c234c9/index.mjs#L...

But it's great for resume and portfolio.

This is the problem - how to disincentivise that behaviour?

Re: Malicious code in the purescript NPM installer

#125

Earlier quoted context omitted.

I beg your pardon, but if I am using this library as part of a shipping piece of software-as-a-service, and I am in the middle of shipping a new feature when suddenly things mysteriously crash... If I later discover that the crash was put there deliberately, I am going to call that malice, and malice that has directly impacted a functioning business and its customers. It's no different than a disgruntled person putti…

It's malicious. That being said, I always get pushback when I mention this but I think SaaS projects should often be vendoring dependencies. It's safer, it's more secure, it gives you more consistent installs -- and it prevents `leftpad` scenarios. It makes source control slightly more complicated, but the other benefits (often) greatly outweigh that. This is something that used to be more commonplace in the Javascri…

Vendoring as practice isn’t common in some ecosystems (ruby, JavaScript, python, Clojure), but I do see more people using caching proxies and services like JFrog’s to ensure they always have access to particular versions of a dependency.

Sadly, this still doesn’t fix non-repudiation problems we see in ecosystems that don’t enforce things like package signing.

Re: Malicious code in the purescript NPM installer

#126

Another reminder of how annoying it is for a package system to have unqualified package names. Having to ask someone to gift a `purescript` package shouldn't even be a thing. It should've been `@shinn/purescript` and the compiler developers just create their own `@whatever/purescript`. This is something Elm and many others got right. https://package.elm-lang.org/ It's just infinitely, obviously better. You see all so…

Even PHP gets this right. It's not hard. It makes me wonder why npm hasn't already moved to namespaced package names.

They have, its just optional.

Re: Malicious code in the purescript NPM installer

#127
post #2

I wonder how bad will this cred-stuffing package authors problem will get before npm/other package managers flat out require 2FA for maintainers

I mean, do you really think some hacker compromised @shinnn's account, solely for the purpose of sabotaging a new installer that had only been published for 8 hours? I mean, I'm all for benefit of the doubt and such, but it's pretty obvious what happened here.

This was my gut reaction, but on further thought, this whole thing seems so needlessly petty that it could have easily been the author attempting to make the other person look bad.

Re: Malicious code in the purescript NPM installer

#128

Earlier quoted context omitted.

After 10 years of nodejs I can honestly say I wouldn’t mind the friction. NPM is a wasteland of abandoned packages and reinventing the wheel. They never solved discovery so you have 500x implementations of the exact same thing. Around 2015 we passed the point where looking for the “right” package takes longer than writing your own.

See, .NET get a lot of hate from the open source community, but this reason is one of the big ones of why I prefer it. Even when you compare it to Java, I feel like it's way better in this regard. If I want to work with JSON, I use Newtonsoft.JSON. If I want an ORM I'll use Dapper (lightweight) or Entity Framework. So many libraries that would you need if you're using Java or JS is just built in to the standard libra…

> I know it's not a 100% fair comparison, since I am biased.

It might also have something to do with you apparently unironically comparing a framework to a programming language.

Re: Malicious code in the purescript NPM installer

#129
post #56

Earlier quoted context omitted.

A lot of those packages are going to be versions months or sometimes years behind the latest version. I'm not convinced this is a model that can work for programming libraries.

It does work, in practice, and has for years. Every package in the Debian (or Ubuntu, or FreeBSD, etc.) package repos depends only on other packages in those repos and on the base OS. It works fine. Packages being months behind the latest version is a feature, not a bug — it means things will only be randomly changing under your feet rarely, with the exception of security fixes.

> Packages being months behind the latest version is a feature, not a bug — it means things will only be randomly changing under your feet rarely, with the exception of security fixes.

If things are "randomly changing" by updates, that means the upstream package isn't following semantic versioning practices, and more importantly, isn't preserving backwards compatibility with their releases. That's a mark of bad software development practices, and it also isn't solved by an arbitrary wait period: that just means months after the breaking change is done, you finally notice and complain, but most maintainers are going to (rightfully) ignore you by that point.

I'd make the same argument in general software quality: with new features, often come new bugs, so by delaying, you can delay introduction of those bugs. However, bugs are easier to fix the sooner they're found, so again, quick turn-around improves things, even if it sometimes causes short-term pain.

This is one thing where NPM is definitely miles ahead of APT. With APT, you get a single version of each package, so it's all or nothing. With NPM, you can specify `1.1.x` so even if a version 1.2 or 2.0 comes out, you're on the stable old one. The closest thing that seems to happen with linux packaging is on a major version (with backwards-incompatible changes) a new package name is created with a "2" on the end, to signal this incompatibility -- how is that anything but a hacky workaround to not having proper versioning support?

Re: Malicious code in the purescript NPM installer

#130
post #16

Before "tree shaking" I stored all npm modules in SCM and reviwed all updates as I had to commit after "npm update". I also put ton of files in .ignore as 90% of files in some packages are not required. I also used to include npm modules in distribution/deployment. So my request to npm is to add an option in the main package.json to disable tree shaking.

I wish there was a way to "bless" packages when they were reviewed.

I want a network of trust, such that a Google reviewed package is worth 10 points, a package fuzzed by foobar is worth 2 points, something skimmed by a dependant user is worth 1 point etc.

I can then chose a compromise between a highly rated/reviewed dependencies and functionality/risk/cost-to-review.

My own blessing of a package I have reviewed might become a very small signal in a web of trust.

Post reply on HN