Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Embedded malware in RC (NPM package)

github.com

Post reply on HN
Print view View original

21–30 of 117 posts

Re: Embedded malware in RC (NPM package)

#21

Post by schemescape »

iancarroll wrote: post #8
schleck8 wrote: post #4

And yet again, twice in a row this time. Note how the referenced Virustotal result has 40+ detections [1]. I'm still wondering why info like this isn't used by Pypi and NPM. Chocolatey has Virustotal integration for all releases. And it's not like Virustotal is the only option, there is Cape [2] for dynamic execution, Metadefender, and Intezer Analyze just to name a few. Really confusing for such a vital supply chain…

It’s not clear that this would be useful; at least for the coa package, the DLL was downloaded dynamically via a script, so NPM would not have been able to detect it unless the script itself was flagged. Not sure what Chocolatey does, but it’s also hard to threshold on VirusTotal when there are a lot of FPs by random vendors.

Given that these attacks are becoming increasingly common, package registries could at least install each package (prior to publishing) in some isolated container or VM and then run some similar malware detection on the resulting file system.

Honestly, I'm strongly considering moving away from the NPM ecosystem because it's clearly become a target for malware.

Re: Embedded malware in RC (NPM package)

#22

Post by kitsunesoba »

megumax wrote: post #18
havkd wrote: post #12

Earlier quoted context omitted.

Command line argument parsing and config loading both seem like something that the standard library should provide.

Ok, now, what languages beside Python and Go provide Command line argument parsing? And Go doesn't do that in a `professional` way. You either write your own, which can easily turn into a clusterfuck or use a third party library. Even in Go, people use cobra[1]. Also embedding a lot of functionality in a standard library isn't great as well, because if some vulnerability is found, it's really hard to patch it, becaus…

It's not part of the standard library, but Swift has the first-party ArgumentParser[0]. Other languages could use a similar model (though what "first party" means for JavaScript is unclear).

[0]: https://github.com/apple/swift-argument-parser

Re: Embedded malware in RC (NPM package)

#23

Post by thrashh »

schemescape wrote: post #21
iancarroll wrote: post #8

Earlier quoted context omitted.

It’s not clear that this would be useful; at least for the coa package, the DLL was downloaded dynamically via a script, so NPM would not have been able to detect it unless the script itself was flagged. Not sure what Chocolatey does, but it’s also hard to threshold on VirusTotal when there are a lot of FPs by random vendors.

Given that these attacks are becoming increasingly common, package registries could at least install each package (prior to publishing) in some isolated container or VM and then run some similar malware detection on the resulting file system. Honestly, I'm strongly considering moving away from the NPM ecosystem because it's clearly become a target for malware.

But attackers are not dumb. They would circumvent whether loose checks the package manager may have. Just considering your suggestion, the obvious immediate exploit is to not deploy the attack payload right away. Nothing you will think of will evade defeat.

Re: Embedded malware in RC (NPM package)

#24

Post by morelisp »

megumax wrote: post #18
havkd wrote: post #12

Earlier quoted context omitted.

Command line argument parsing and config loading both seem like something that the standard library should provide.

Ok, now, what languages beside Python and Go provide Command line argument parsing? And Go doesn't do that in a `professional` way. You either write your own, which can easily turn into a clusterfuck or use a third party library. Even in Go, people use cobra[1]. Also embedding a lot of functionality in a standard library isn't great as well, because if some vulnerability is found, it's really hard to patch it, becaus…

> what languages beside Python and Go provide Command line argument parsing?

Even POSIX gives you getopt(1) and getopt(3). What other language doesn't? I can only think of Java.

Re: Embedded malware in RC (NPM package)

#25

Post by hn_throwaway_99 »

One of the thing I wish was really much easier to do with NPM is, when running `npm update`, to only pick up the most recent compatible versions from X days ago.

That is, for sensitive apps, I don't want to use versions that are less than, say, a month or so old unless I specifically override it. I want to stay up-to-date but not too bleeding edge, specifically to avoid situations like this.

Re: Embedded malware in RC (NPM package)

#26

Post by schemescape »

thrashh wrote: post #23
schemescape wrote: post #21

Earlier quoted context omitted.

Given that these attacks are becoming increasingly common, package registries could at least install each package (prior to publishing) in some isolated container or VM and then run some similar malware detection on the resulting file system. Honestly, I'm strongly considering moving away from the NPM ecosystem because it's clearly become a target for malware.

But attackers are not dumb. They would circumvent whether loose checks the package manager may have. Just considering your suggestion, the obvious immediate exploit is to not deploy the attack payload right away. Nothing you will think of will evade defeat.

I agree that it is an unending arms race, but if NPM doesn't even plug obvious holes (like running install scripts by default), then they've lost my trust.

Edit: if anyone knows of a way to disable NPM from running install scripts automatically (without having to remember to specify --ignore-scripts on each invocation), while still allowing me to use "npm run" to manually run scripts (e.g. test scripts for my own packages), I'd love to hear about it.

Re: Embedded malware in RC (NPM package)

#27

Post by megumax »

schleck8 wrote: post #4

And yet again, twice in a row this time. Note how the referenced Virustotal result has 40+ detections [1]. I'm still wondering why info like this isn't used by Pypi and NPM. Chocolatey has Virustotal integration for all releases. And it's not like Virustotal is the only option, there is Cape [2] for dynamic execution, Metadefender, and Intezer Analyze just to name a few. Really confusing for such a vital supply chain…

I think that volunteers (some of them maybe paid) should check the validity of code, at least for projects over 10-100k downloads. In case of crates.io (Rust), there is cargo-crev[1]. Also, npm should popularize 2FA.

[1]https://web.crev.dev/rust-reviews/

Re: Embedded malware in RC (NPM package)

#28

Post by megumax »

morelisp wrote: post #24
megumax wrote: post #18

Earlier quoted context omitted.

Ok, now, what languages beside Python and Go provide Command line argument parsing? And Go doesn't do that in a `professional` way. You either write your own, which can easily turn into a clusterfuck or use a third party library. Even in Go, people use cobra[1]. Also embedding a lot of functionality in a standard library isn't great as well, because if some vulnerability is found, it's really hard to patch it, becaus…

> what languages beside Python and Go provide Command line argument parsing? Even POSIX gives you getopt(1) and getopt(3). What other language doesn't? I can only think of Java.

POSIX is not ISO C or C++ standard. On Windows, what are you gonna do?

Also, other languages are Rust, Kotlin, Swift (to name a few `modern` ones). Yes, Kotlin and Swift have `first class` CLI parsing libraries, but they are not part of standard library.

Re: Embedded malware in RC (NPM package)

#29

Post by woodruffw »

schleck8 wrote: post #4

And yet again, twice in a row this time. Note how the referenced Virustotal result has 40+ detections [1]. I'm still wondering why info like this isn't used by Pypi and NPM. Chocolatey has Virustotal integration for all releases. And it's not like Virustotal is the only option, there is Cape [2] for dynamic execution, Metadefender, and Intezer Analyze just to name a few. Really confusing for such a vital supply chain…

> Note how the referenced Virustotal result has 40+ detections. I'm still wondering why info like this isn't used by Pypi and NPM.

I was contracted to help build a malware analysis pipeline for PyPI[1][2]. We don't currently have a VirusTotal detector/analyzer (IIRC, we couldn't get a high-enough volume API token on short order), but I think any work towards that would be greatly appreciated by both the PyPA members and the Python packaging community!

[1]: https://pyfound.blogspot.com/2018/12/upcoming-pypi-improveme...

[2]: https://github.com/pypa/warehouse/tree/main/warehouse/malwar...

Re: Embedded malware in RC (NPM package)

#30

Post by rndhouse »

I've created Vouch in an attempt to address this problem:

https://github.com/vouch-dev/vouch

Vouch lets users create and share reviews for NPM packages. Project dependencies can then be checked against those reviews.

Vouch uses extensions to interface with package ecosystems. It's simple to create a new extension. Extensions currently exist for NPM, PyPi, and Ansible Galaxy.

I'm currently working on a website to index known reviews and publish official reviews.

I hope you guys find it useful! Drop by the Matrix channel if you have any feedback to share: #vouch:matrix.org

Post reply on HN