Given that most of these kind of attacks are detected relatively quickly, NPM should implement a feature where it doesn't install/upgrade packages newer than 3 days, and just use the previous version.
[deleted]
NPM debug and chalk packages compromised
101–110 of 796 posts
Re: NPM debug and chalk packages compromised
#102The malware steals crypto in end-user browsers. Another one for “web3 is going great”…
I dislike web3 and the overuse of crypto as much as you do. But look at the nature of the exploit. It isn't limited to crypto or web3. There are other secrets and sensitive information that browsers regularly hold in their memory. What about them?
Yeah cryptoassets are probably just the easiest thing to monetize.
Re: NPM debug and chalk packages compromised
#103Earlier quoted context omitted.
Meanwhile in Python: 134 million weekly downloads, seemingly slowly trending upward over time, for https://pypistats.org/packages/six which provides third-party compatibility for a version of Python that dropped support over five years ago.
The code is 813 lines [0]. Not saying everyone should use it but these two are not directly comparable. [0] https://github.com/benjaminp/six/blob/main/six.py
It is much more code, but it should be even more useless. (No slight intended to Benjamin Peterson.) The 2.7 window was already extended to give everyone a chance to migrate.
Re: NPM debug and chalk packages compromised
#104One of the most insidious parts of this malware's payload, which isn't getting enough attention, is how it chooses the replacement wallet address. It doesn't just pick one at random from its list. It actually calculates the Levenshtein distance between the legitimate address and every address in its own list. It then selects the attacker's address that is visually most similar to the original one. This is a brilliant…
> This is a brilliant piece of social engineering baked right into the code. It's designed to specifically defeat the common security habit ...
I don't agree that the exuberance over the brilliance of this attack is warranted if you give this a moment's thought. The web has been fighting lookalike attacks for decades. This is just a more dynamic version of the same.
To be honest, this whole post has the ring of AI writing, not careful analysis.
Re: NPM debug and chalk packages compromised
#105Luckily this seems to be browser-specific, and not cryptocurrency malware that runs in Node.js environments, so it might be wise for us all to do some hardening on our software, and make sure we're doing things like version pinning. Edit: As of this morning, `npm audit` will catch this.
Run anything in some sort of container or sandbox
Re: NPM debug and chalk packages compromised
#106When I run `npm audit`, it points me to a security advisory at GitHub. For example, for debug, it is https://github.com/advisories/GHSA-8mgj-vmr8-frr6 .
That page says that the affected versions are ">=0". Does that seem right? That page also says:
> Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Is this information accurate?
Re: NPM debug and chalk packages compromised
#107Maintainer phished. Was caught quickly (hours? hard to be sure, the versions have been removed/overwritten). Attacker owns npmjs.help domain.
Noticed that after ten mins, contacted author immediatly and he seems to be working on it / restoring his account / removing malware on published packages. Kinda "proud" on it haha :D
Doesn’t npmjs do things like signing, pinning, and yanking packages, like rubygems?
Re: NPM debug and chalk packages compromised
#108As an outsider to the npm ecosystem, reading this list of packages is astonishing. Why do js people import someone else's npm module for every little trivial thing?
Lack of a good batteries-included stdlib. You're either importing a ton of little dependencies (which then depend on other small libraries) or you end up writing a ton of really basic functionality yourself.
I just never got the argument against including things like the sort of text formatting tools and such that people always import libraries for. It’s not like an embedded system for mission-critical realtime applications where most functions people write for it get formal proofs — it’s freaking javascript. Sure it’s become a serious tool used for serious tasks for some reason, but come on.
Re: NPM debug and chalk packages compromised
#109> Yes, I've been pwned. First time for everything, I suppose. It was a 2FA reset email that looked shockingly authentic. I should have paid better attention, but it slipped past me. Sincerely sorry, this is embarrassing. My worst nightmare is to wake up, see an email like that and hastily try to recover it while still 90% asleep, compromising my account in the process. However, I think I can still sleep safe consider…
I agree, and this is arguably the best reason to use a password manager (with the next being lack of reuse which automatically occurs if you use generated passwords, and then the next being strength if you use generated passwords). I generally recommend Google's to any Android users, since it suggests your saved password not only based on domain in Chrome browser, but also based on registered appID for native apps, t…
I'm a pretty big fan of BitWarden/VaultWarden myself... though relatively recently something changed on my Android phone in that the password fills aren't working from inside my browser, I have to copy/paste from the app, which is not only irritating but potentially less safe.
Re: NPM debug and chalk packages compromised
#110I thought it stupid that there were some old established electro-mechanical manufacturing companies that would just block github.com and Internet downloads in general, only allowing codes from internal repos that took months to get approved, breaking npm dependent workflows.
Now? Why aren't everyone setting up own GitHub mirrors is beyond me, almost. They were 100% right.