DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware
1–10 of 296 posts
Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware
#2> An attacker published new versions of four of duckdb’s packages that included malicious code to interfere with cryptocoin transactions
How can anyone publish their packages?
Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware
#3> An attacker published new versions of four of duckdb’s packages that included malicious code to interfere with cryptocoin transactions How can anyone publish their packages?
[deleted]
Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware
#4> According to the npm statistics, nobody has downloaded these packages before they were deprecated
Is this actually accurate? Packages with weekly downloads in the hundreds of thousands, yet in the 4+ hours that the malicious versions were up for, not a single person updated any of them to the latest patch release?
Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware
#5> An attacker published new versions of four of duckdb’s packages that included malicious code to interfere with cryptocoin transactions How can anyone publish their packages?
There is a detailed postmortem in the linked ticket explaining exactly how this happened.
Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware
#6Comes with the territory considering that npm is defacto the number one enshittification dependency by now. But no worries - this will scale beautifully.
downvotes appreciated but also happy to see one or two urls that would prove me wrong
Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware
#7> An attacker published new versions of four of duckdb’s packages that included malicious code to interfere with cryptocoin transactions How can anyone publish their packages?
There is a detailed postmortem in the linked ticket explaining exactly how this happened.
This is the same phishing attack that hit junon yesterday.
Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware
#8> An attacker published new versions of four of duckdb’s packages that included malicious code to interfere with cryptocoin transactions How can anyone publish their packages?
The attacker emailed a maintainer from a legitimate looking email address. The maintainer clicked the link and reset their credentials on a legitimate looking website. The attacker then signs into the legitimate duckdb account and publishes their new package.
This is the second high-profile instance of the technique this week.
Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware
#9> An attacker published new versions of four of duckdb’s packages that included malicious code to interfere with cryptocoin transactions How can anyone publish their packages?
The attacker emailed a maintainer from a legitimate looking email address. The maintainer clicked the link and reset their credentials on a legitimate looking website. The attacker then signs into the legitimate duckdb account and publishes their new package. This is the second high-profile instance of the technique this week.
2FA for such high profile packages should be enforced
Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware
#10[deleted]