It seems that all of these should be cryptographically signed by a developer's private key before publication and then verified by others before use. Is that not the case?
Embedded Malware in Coa
21–30 of 86 posts
Re: Embedded Malware in Coa
#22Is https://www.virustotal.com good? I saw it referenced but never used
[deleted]
Re: Embedded Malware in Coa
#23It seems that all of these should be cryptographically signed by a developer's private key before publication and then verified by others before use. Is that not the case?
There seems to be a call for action [0] directed at NPM.
[0] https://www.change.org/p/npm-please-secure-package-releasing
Re: Embedded Malware in Coa
#24What a worthless advisory, how about sharing who could possibly be affected at the very top, or at least anywhere? Going to the issue, it seems the `preinstall` field was changed to `start /B node compile.js & node compile.js",` which means this would only run on Windows machines, everyone else seems to be unaffected. Here is how you can find out if you have the affected package on your machine/instance: find ~/proje…
"Bleeping Computer" published screenshots of it (and also has some analysis), https://www.bleepingcomputer.com/news/security/popular-coa-n...
So if I’m reading this correctly, only Windows hosts are directly affected by the malware. On macOS and Linux one only needs to rollback to a healthy version of the package?
Re: Embedded Malware in Coa
#25As bad as this may sound, this is why a love Open Source, npm and the JavaScript ecosystem. It super easy to audit and check the code. What is missing is more automated and recurrent checks in all the packages and downstream dependencies.
This is a really odd comment. Npm, and the strange, insecure JavaScript packaging ecosystem is the reason this happened in the first place.
Re: Embedded Malware in Coa
#26As bad as this may sound, this is why a love Open Source, npm and the JavaScript ecosystem. It super easy to audit and check the code. What is missing is more automated and recurrent checks in all the packages and downstream dependencies.
I just can't agree with this. The problems npm has are not new, surprising ones. They are happily letting people upload malware.
https://my.diffend.io/npm/coa/2.0.3/2.0.4/
In 2021, why on earth does such a change not trigger a review before release?
Re: Embedded Malware in Coa
#27NPM seems to be a lot of issues
https://github.com/advisories?page=1&query=malware
Re: Embedded Malware in Coa
#28Looks like you might be compromised by this rogue Coa package if you use Windows and you installed or updated npm packages on November 4.
Re: Embedded Malware in Coa
#29It seems like this was caught soon because it broke many builds. Imagine if this change was hidden better.
Correct:
[0] -> Error: Cannot find module '/Users/me/.npm/_npx/27078/lib/node_modules/@svgr/cli/node_modules/coa/compile.js'
What happened there was that he got the broken update, 2.0.3 which just referenced and used compile.js, but didn't include the file.
Then 2.0.4 came out which included compile.js and compile.bat.
Had he updated a couple of minutes later, this error would not have appeared. Not sure if /Users/ is a MacOS thing, but it is a Windows path structure, which might indicate that he was running this on Windows. And in that case he would have been compromised.
Re: Embedded Malware in Coa
#30This makes me appreciate Deno's focus on security. Having things like file and network access 'opt in' seems like a no brainer when we see how easy it is to simply install an npm package and find yourself vulnerable to malware.