I've come to the conclusion that avoiding the npm registry is a great benefit. The alternative is to import packages directly from the (git) repository. Apart from being a major vector for supply-chain attacks like this one, it is also true that there is little or no coupling between the source of a project and its published code. The 'npm publish' step takes pushes local contents into the registry, meaning that a malefactor can easily make changes to code before publishing.
NPM debug and chalk packages compromised
121–130 of 796 posts
Re: NPM debug and chalk packages compromised
#122As an outsider to the npm ecosystem, reading this list of packages is astonishing. Why do js people import someone else's npm module for every little trivial thing?
This is spreading everywhere, Rust, Python, ...
The difference, at least in languages like Java or Python, is that there is a pretty strong "standard" library that ships with the language, and which one can assume will be kept up-to-date. It is very hard to assume that for NPM or Rust or any other crowd-sourced library system.
Re: NPM debug and chalk packages compromised
#123looks like it won't affect you if you just downloaded the packages locally. the actual code only runs in a browser context - it replaces all crypto addresses in many places with the attacker's. a list of the attacker's wallet addresses: https://gist.github.com/sindresorhus/2b7466b1ec36376b8742dc7...
I wonder why they didn't add something more nefarious that can run on developers machines while they were at it, would it have been too easy to see? It was caught very quickly anyway.
Re: NPM debug and chalk packages compromised
#124A super quick script to check the deps in your package-lock.json file is here[0]. [0]: https://gist.github.com/martypitt/0d50c350aa7f0fc73354754343...
how about: grep -r "_0x112fa8"
Irritatingly, this doesn't turn up anything, despite having a theoretically-compromised project as per the package-lock.json… At least on my end
Re: NPM debug and chalk packages compromised
#125Earlier quoted context omitted.
That it had been more than 12 months since last updating them. Npm has done outreach before about doing security changes/enhancements in the past so this didn't really catch me. Screenshot here: https://imgur.com/a/q8s235k
That green checkmark ... what application is this?
check marks in email clients usually mean DKIM / other domain verification passed. The attack author truly owns npmjs.help, so a checkmark is appropriate.
Re: NPM debug and chalk packages compromised
#126Wow, I also received the same phishing email even though my packages only have a few hundred downloads a week (eg. bsky-embed).
So I guess a lot more accounts/packages might be affected than the ones stated in the article
Re: NPM debug and chalk packages compromised
#127One of the most insidious parts of this malware's payload, which isn't getting enough attention, is how it chooses the replacement wallet address. It doesn't just pick one at random from its list. It actually calculates the Levenshtein distance between the legitimate address and every address in its own list. It then selects the attacker's address that is visually most similar to the original one. This is a brilliant…
> This is a brilliant piece of social engineering baked right into the code. It's designed to specifically defeat the common security habit ... I don't agree that the exuberance over the brilliance of this attack is warranted if you give this a moment's thought. The web has been fighting lookalike attacks for decades. This is just a more dynamic version of the same. To be honest, this whole post has the ring of AI wr…
> To be honest, this whole post has the ring of AI writing, not careful analysis.
No it doesn't?
Re: NPM debug and chalk packages compromised
#128looks like it won't affect you if you just downloaded the packages locally. the actual code only runs in a browser context - it replaces all crypto addresses in many places with the attacker's. a list of the attacker's wallet addresses: https://gist.github.com/sindresorhus/2b7466b1ec36376b8742dc7...
that will still affect users of your website that uses these packages, tho.
Re: NPM debug and chalk packages compromised
#129From sindresorhus:
You can run the following to check if you have the malware in your dependency tree:
`rg -u --max-columns=80 _0x112fa8`
Requires ripgrep:
`brew install rg`
https://github.com/chalk/chalk/issues/656#issuecomment-32668...
Re: NPM debug and chalk packages compromised
#130Hi, yep I got pwned. Sorry everyone, very embarrassing. More info: - https://github.com/chalk/chalk/issues/656 - https://github.com/debug-js/debug/issues/1005#issuecomment-3... Affected packages (at least the ones I know of): - ansi-styles@6.2.2 - debug@4.4.2 (appears to have been yanked as of 8 Sep 18:09 CEST) - chalk@5.6.1 - supports-color@10.2.1 - strip-ansi@7.1.1 - ansi-regex@6.2.1 - wrap-ansi@9.0.1 - color-conve…
Thanks for sounding the alarm. I've sent an abuse email to porkbun to hopefully get the domain taken down.