Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Embedded malware in RC (NPM package)

github.com

Post reply on HN
Print view View original

61–70 of 117 posts

Re: Embedded malware in RC (NPM package)

#61

Post by qwerty2021 »

afavour wrote: post #49
qwerty2021 wrote: post #15

Earlier quoted context omitted.

>Command line argument parsing 20-30 LoC maybe. `process.argv.slice(2).forEach(str => ... )`. there is no access to the raw command-line invocation, sadly, so you really can't really do anything fancier than that. >config loading that thing "RC" package does - looking up the config file in random locations - is really strange to me. aren't you the one in control of where it is stored?

Just looking at the readme for Coa it’s very obviously more than the code you outlined. You’re arguing against a strawman here.

honestly, yeah. I just saw "command line parser" and dismissed the rest as useless bloat

Re: Embedded malware in RC (NPM package)

#62

Post by jffry »

schemescape wrote: post #54
Ginden wrote: post #40

Earlier quoted context omitted.

npm ci --ignore-scripts

Ah, sorry, I meant a way to automatically do that (both so I don't have to type as much and so that I can't accidentally forget to add that argument). Edited my comment to reflect this.

You can run this

  npm config set ignore-scripts true
which will update ~/.npmrc (you can also create project-specific .npmrc files if you prefer)

You can see how NPM has been configured by running

  npm config list

Re: Embedded malware in RC (NPM package)

#63

Post by speeder »

bluefox wrote: post #57

Is the advisory genuine? It links to the github repo, where the latest commit is from 2018 for version 1.2.8. It links to npmjs page, that shows 48 versions, where the latest version is 1.2.8 from "3 years ago". Yet it has 1.2.9/1.3.9/2.3.9 for "Affected versions". Did npmjs "revert" these versions and any clue of their existence? The npmjs page links to dominictarr's repository. The npmjs site doesn't seem to have a…

I saw in one of the repos the maintainer confused about what happened, seemly someone somehow impersonated him and released new versions to npm without actually touching the repo itself!

Re: Embedded malware in RC (NPM package)

#64

Post by MrStonedOne »

megumax wrote: post #18
havkd wrote: post #12

Earlier quoted context omitted.

Command line argument parsing and config loading both seem like something that the standard library should provide.

Ok, now, what languages beside Python and Go provide Command line argument parsing? And Go doesn't do that in a `professional` way. You either write your own, which can easily turn into a clusterfuck or use a third party library. Even in Go, people use cobra[1]. Also embedding a lot of functionality in a standard library isn't great as well, because if some vulnerability is found, it's really hard to patch it, becaus…

php

Re: Embedded malware in RC (NPM package)

#65

Post by voldacar »

afavour wrote: post #39
morelisp wrote: post #24

Earlier quoted context omitted.

> what languages beside Python and Go provide Command line argument parsing? Even POSIX gives you getopt(1) and getopt(3). What other language doesn't? I can only think of Java.

Sure, and Node gives you the process.argv array. The point is having higher level APIs than that.

it feels like the more higher level APIs we add, the shittier and more annoying software becomes

Re: Embedded malware in RC (NPM package)

#66

Post by Groxx »

megumax wrote: post #18
havkd wrote: post #12

Earlier quoted context omitted.

Command line argument parsing and config loading both seem like something that the standard library should provide.

Ok, now, what languages beside Python and Go provide Command line argument parsing? And Go doesn't do that in a `professional` way. You either write your own, which can easily turn into a clusterfuck or use a third party library. Even in Go, people use cobra[1]. Also embedding a lot of functionality in a standard library isn't great as well, because if some vulnerability is found, it's really hard to patch it, becaus…

as if there even was one command-line or config standard. especially across different operating systems.

it absolutely does not belong in stdlibs, where it can never be changed. that's how you end up with too many terrible CLI tools using Go's `flags` package.

Re: Embedded malware in RC (NPM package)

#67

Post by m4rtink »

megumax wrote: post #27
schleck8 wrote: post #4

And yet again, twice in a row this time. Note how the referenced Virustotal result has 40+ detections [1]. I'm still wondering why info like this isn't used by Pypi and NPM. Chocolatey has Virustotal integration for all releases. And it's not like Virustotal is the only option, there is Cape [2] for dynamic execution, Metadefender, and Intezer Analyze just to name a few. Really confusing for such a vital supply chain…

I think that volunteers (some of them maybe paid) should check the validity of code, at least for projects over 10-100k downloads. In case of crates.io (Rust), there is cargo-crev[1]. Also, npm should popularize 2FA. [1] https://web.crev.dev/rust-reviews/

Say, like package maintainers do for major Linux distributions ?

Re: Embedded malware in RC (NPM package)

#68

Post by m4rtink »

madjam002 wrote: post #35

This is like the third one this week right? I know people keep saying about post-install should be opt out but then malware will just wait for first run instead. How about an option to refuse to install any packages that have been published in the past week/2 weeks? That way hopefully malware like this would have been spotted before you end up running it locally.

They could also attack metadata parsers next - I don't think those are very hardened right now.

Re: Embedded malware in RC (NPM package)

#69

Post by throwaway984393 »

rndhouse wrote: post #45
hn_throwaway_99 wrote: post #36

Earlier quoted context omitted.

That's not really the solution for this problem, though, which is very specifically when a project maintainer's account gets compromised, so then the bad guys publish a new malicious version of that library that gets picked up by anyone using non-pinned NPM versions (i.e. most everyone). There are a couple more straightforward ways to do this: 1. Require 2FA, ideally hardware key 2FA, for anyone publishing a package…

Reviews in Vouch refer to a particular version of a software package. If a new release is issued by a malicious actor, the new release would require a new review. But the review process does not need to re-start from scratch. Reviews from other versions can be used to lessen the workload. On the subject of automatically updating packages: the Vouch dependency analysis can be included in CI. Un-reviewed or review fail…

Who's reviewing the software package's dependencies?

Re: Embedded malware in RC (NPM package)

#70

Post by drdaeman »

ricardobayes wrote: post #38

Seems like a good choice to work at a cybersecurity company these days. Job security is guaranteed.

Yea, but you'll end up cursing everything about computing because everyone and their dog starts their day with another `curl | sudo bash` pipe that installs something all across the system pulling in a metric shitton of random packages and you can't even imagine why all this nonsense is needed for a hello world app.
Post reply on HN