Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM debug and chalk packages compromised

aikido.dev

Post reply on HN
Print view View original

31–40 of 796 posts

Re: NPM debug and chalk packages compromised

#31

Post by nodesocket »

artooro wrote: post #16
nodesocket wrote: post #13

This is terrifying. Reminder to store your crypto in a hardware based wallet like Ledger not browser based. Stay frosty when making transfers from exchanges.

While true, this is also an eye opening event of how much worse it could be if it was more generic and not limited to crypto wallet addresses.

Seems like exchanges should have a confirmation screen that shows the destination addresses from XHR requests before processing, though I suppose the malicious script could just change the DOM showing the address you entered instead of the modified address it injected.

Re: NPM debug and chalk packages compromised

#32

Post by thewebguyd »

stathibus wrote: post #18

As an outsider to the npm ecosystem, reading this list of packages is astonishing. Why do js people import someone else's npm module for every little trivial thing?

Lack of a good batteries-included stdlib. You're either importing a ton of little dependencies (which then depend on other small libraries) or you end up writing a ton of really basic functionality yourself.

Re: NPM debug and chalk packages compromised

#34

Post by jowea »

stathibus wrote: post #18

As an outsider to the npm ecosystem, reading this list of packages is astonishing. Why do js people import someone else's npm module for every little trivial thing?

This conversation been a thing since at least the leftpad event. It's just how the js ecosystem works it seems. The default library is too small perhaps?

Re: NPM debug and chalk packages compromised

#35

Post by klysm »

littlecranky67 wrote: post #22
andrewmcwatters wrote: post #15

@junon, if it makes you feel any better, I once had a Chinese hacking group target my router and hijack my DNS configuration specifically to make "amazon.com" point to 1:1 replica of the site just to steal my Amazon credentials. There was no way to quickly visualize that the site was fake, because it was in fact, "actually" amazon.com. Phishing sucks. Sorry to read about this. Edit: To other readers, yes, the exploit…

How did they get a valid ssl cert though?

Could've been a while ago when SSL certs failures weren't as loud in the browser

Re: NPM debug and chalk packages compromised

#37

Post by nodesocket »

nixosbestos wrote: post #25
nodesocket wrote: post #13

This is terrifying. Reminder to store your crypto in a hardware based wallet like Ledger not browser based. Stay frosty when making transfers from exchanges.

How is it terrifying? They clicked through a 2FA reset email, a process that I have never, and will never need to go through, and seemingly one that they didn't even initiate.

Like you’ve never made a mistake before. Blatantly blaming the maintainer is unfair. They made a mistake, it happens.

Re: NPM debug and chalk packages compromised

#38

Post by felbane »

stathibus wrote: post #18

As an outsider to the npm ecosystem, reading this list of packages is astonishing. Why do js people import someone else's npm module for every little trivial thing?

Extreme aversion to NIH syndrome, perhaps? I agree that it's weird. Sure, don't try to roll your own crypto library but the amount of `require('left-pad')` in the wild is egregious.

Re: NPM debug and chalk packages compromised

#39

Post by bstsb »

looks like it won't affect you if you just downloaded the packages locally.

the actual code only runs in a browser context - it replaces all crypto addresses in many places with the attacker's.

a list of the attacker's wallet addresses: https://gist.github.com/sindresorhus/2b7466b1ec36376b8742dc7...

Re: NPM debug and chalk packages compromised

#40

Post by grishka »

rglover wrote: post #28
stathibus wrote: post #18

As an outsider to the npm ecosystem, reading this list of packages is astonishing. Why do js people import someone else's npm module for every little trivial thing?

You typically don't. But a lot of packages that you do install depend on smaller stuff like this under the hood (not necessarily good and obviously better handled with bespoke code in the package, but is is what it is).

Then the question becomes, why do developers of larger libraries import someone else's module for every little trivial thing?
Post reply on HN