Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM debug and chalk packages compromised

aikido.dev

Post reply on HN
Print view View original

111–120 of 796 posts

Re: NPM debug and chalk packages compromised

#111

Post by FergusArgyll »

nodesocket wrote: post #79
junon wrote: post #45

Earlier quoted context omitted.

That it had been more than 12 months since last updating them. Npm has done outreach before about doing security changes/enhancements in the past so this didn't really catch me. Screenshot here: https://imgur.com/a/q8s235k

Yikes, looks legit. Curious what are the destination addresses? Would like to monitor them to see how much coin they are stealing.

0x66a9893cC07D91D95644AEDD05D03f95e1dBA8Af

0x10ed43c718714eb63d5aa57b78b54704e256024e

0x13f4ea83d0bd40e75c8222255bc855a974568dd4

0x1111111254eeb25477b68fb85ed929f73a960582

0xd9e1ce17f2641f24ae83637ab66a2cca9c378b9f

Source: https://github.com/chalk/chalk/issues/656#issuecomment-32670...

Re: NPM debug and chalk packages compromised

#112

Post by junon »

SSLy wrote: post #64
junon wrote: post #45

Earlier quoted context omitted.

That it had been more than 12 months since last updating them. Npm has done outreach before about doing security changes/enhancements in the past so this didn't really catch me. Screenshot here: https://imgur.com/a/q8s235k

Can you post full message headers somewhere? It'd be interesting which MTA was involved in delivery from the sender's side.

Yep - https://gist.github.com/Qix-/c1f0d4f0d359dffaeec48dbfa1d40ee...

Re: NPM debug and chalk packages compromised

#113

Post by peaseagee »

hunter2_ wrote: post #60
diggan wrote: post #11

> Yes, I've been pwned. First time for everything, I suppose. It was a 2FA reset email that looked shockingly authentic. I should have paid better attention, but it slipped past me. Sincerely sorry, this is embarrassing. My worst nightmare is to wake up, see an email like that and hastily try to recover it while still 90% asleep, compromising my account in the process. However, I think I can still sleep safe consider…

I agree, and this is arguably the best reason to use a password manager (with the next being lack of reuse which automatically occurs if you use generated passwords, and then the next being strength if you use generated passwords). I generally recommend Google's to any Android users, since it suggests your saved password not only based on domain in Chrome browser, but also based on registered appID for native apps, t…

I use Bitwarden on Android and on web and it is aware of app IDs and (usually) correctly maps them. If it's missing, you can force the mapping [yes this is moderately dangerous] and report it to Bitwarden so other users get the benefit.

Re: NPM debug and chalk packages compromised

#114

Post by bflesch »

DDerTyp wrote: post #52

One of the most insidious parts of this malware's payload, which isn't getting enough attention, is how it chooses the replacement wallet address. It doesn't just pick one at random from its list. It actually calculates the Levenshtein distance between the legitimate address and every address in its own list. It then selects the attacker's address that is visually most similar to the original one. This is a brilliant…

Can you attribute this technique to a specific group?

Re: NPM debug and chalk packages compromised

#115

Post by progbits »

skydhash wrote: post #49
thewebguyd wrote: post #32

Earlier quoted context omitted.

Lack of a good batteries-included stdlib. You're either importing a ton of little dependencies (which then depend on other small libraries) or you end up writing a ton of really basic functionality yourself.

But why can’t we have a good library instead of those mini thingies?

For C++ there are Boost, Folly, Absl, several more large libraries with reputable orgs behind them. I'm surprised someone doesn't make a big npm lib like that.

Not hating on the author but I doubt similar compromise would happen to Facebook or Google owned package.

Re: NPM debug and chalk packages compromised

#116

Post by anticristi »

This is really scary. It could have totally happened to me too. How can we design security which works even when people are tired or stressed?

Once upon a time, I used a software called passwordmaker. Essentially, it computed a password like hash(domain+username+master password). Genius idea, but it was a nightmare to use. Why? Because amazon.se and amazon.com share the same username/password database. Similarly, the "domain" for Amazon's app was "com.amazon.something".

Perhaps it's time for browser vendors to strongly bind credentials to the domain, the whole domain and nothing but the domain, so help me Codd.

Re: NPM debug and chalk packages compromised

#117

Post by junon »

lifeinthevoid wrote: post #93
junon wrote: post #45

Earlier quoted context omitted.

That it had been more than 12 months since last updating them. Npm has done outreach before about doing security changes/enhancements in the past so this didn't really catch me. Screenshot here: https://imgur.com/a/q8s235k

That green checkmark ... what application is this?

Migadu. The tooltip hovering over it shows:

    dkim=pass header.d=smtp.mailtrap.live header.s=rwmt1 header.b=Wrv0sR0r

Re: NPM debug and chalk packages compromised

#118

Post by skybrian »

mcintyre1994 wrote: post #53
dist-epoch wrote: post #36

Given that most of these kind of attacks are detected relatively quickly, NPM should implement a feature where it doesn't install/upgrade packages newer than 3 days, and just use the previous version.

Would it be spotted quickly if nobody got the update though? It'd probably just go undetected for 3 days instead. In this case one team spotted it because their CI picked up the new version ( https://jdstaerk.substack.com/p/we-just-found-malicious-code... ).

The question is who picks up the vulnerable version first. With minimal version selection (like Go has), the people with a direct dependency on the vulnerable library go first, after running a command to update their direct dependencies. People with indirect dependencies don’t get the new version until a direct dependency does a release pointing at the vulnerable version, passing it on.

Not sure if that would be a better result in the end. It seems like it depends on who has direct dependencies and how much testing they do. Do they pass it on or not?

Re: NPM debug and chalk packages compromised

#119

Post by junon »

jvuygbbkuurx wrote: post #81
junon wrote: post #26

Earlier quoted context omitted.

Ignore anything coming from npm you didn't expect. Don't click links, go to the website directly and address it there. That's what I should have done, and didn't because I was in a rush. Don't do security things when you're not fully awake, too. Lesson learned. The email was a "2FA update" email telling me it's been 12 months since I updated 2FA. That should have been a red flag but I've seen similarly dumb things co…

Did they also phish the login password after clicking the link or did they already have it?

They phished username, password (unique to npm), and a TOTP code.

They even gave me a new TOTP code to install (lol) and it worked. Showed up in authy fine. Whoever made this put a ton of effort into it.

Re: NPM debug and chalk packages compromised

#120

Post by andrewmcwatters »

wch wrote: post #106

When I run `npm audit`, it points me to a security advisory at GitHub. For example, for debug, it is https://github.com/advisories/GHSA-8mgj-vmr8-frr6 . That page says that the affected versions are ">=0". Does that seem right? That page also says: > Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediatel…

No. A now unavailable version, `debug@4.4.2` was unpublished by npm, which is the only vulnerable version in question.

Edit: However, I think the reason the security advisory marks the entire package at the moment, is because there is no mechanism in npm to notify users a version with an exploit is currently installed. `npm audit` looks at the versions configured, not installed.

The security advisory triggering this warning forces everyone to reinstall packages today, in case 4.4.2 was installed.

Post reply on HN