Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

github.com

Post reply on HN
Print view View original

11–20 of 296 posts

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#11

Post by diggan »

bakugo wrote: post #4

> According to the npm statistics, nobody has downloaded these packages before they were deprecated Is this actually accurate? Packages with weekly downloads in the hundreds of thousands, yet in the 4+ hours that the malicious versions were up for, not a single person updated any of them to the latest patch release?

I think that's pretty unlikely. I aren't even a high-profile npm author, and if I publish any npm package they end up being accessed/downloadaded within minutes of first publish, and any update after that.

I also know projects who are reading the update feeds and kick off CI jobs after any dependencies are updated to automatically test version upgrades, surely at least one dependent of DuckDB is doing something similar.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#12

Post by diggan »

So far, it seems to be a bog-standard phishing email, with not much novelty or sophistication, seems the people running the operation got very lucky with their victims though.

I'm starting to think we haven't even seen the full scope of it yet, two authors confirmed as compromised, must be 10+ out there we haven't heard of yet?

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#13

Post by jsheard »

arewethereyeta wrote: post #9
OtherShrezzing wrote: post #8

Earlier quoted context omitted.

The attacker emailed a maintainer from a legitimate looking email address. The maintainer clicked the link and reset their credentials on a legitimate looking website. The attacker then signs into the legitimate duckdb account and publishes their new package. This is the second high-profile instance of the technique this week.

2FA for such high profile packages should be enforced

It is, if your packages are popular enough then npm will force you to enable 2FA. They started doing that a few years ago. It clearly doesn't stop everything though, the big attack yesterday went through 2FA by tricking the author into doing a "2FA reset".

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#14

Post by koakuma-chan »

arewethereyeta wrote: post #9
OtherShrezzing wrote: post #8

Earlier quoted context omitted.

The attacker emailed a maintainer from a legitimate looking email address. The maintainer clicked the link and reset their credentials on a legitimate looking website. The attacker then signs into the legitimate duckdb account and publishes their new package. This is the second high-profile instance of the technique this week.

2FA for such high profile packages should be enforced

He would have entered 2FA too

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#17

Post by frizlab »

jsheard wrote: post #13
arewethereyeta wrote: post #9

Earlier quoted context omitted.

2FA for such high profile packages should be enforced

It is, if your packages are popular enough then npm will force you to enable 2FA. They started doing that a few years ago. It clearly doesn't stop everything though, the big attack yesterday went through 2FA by tricking the author into doing a "2FA reset".

Passkeys should be enforced

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#18

Post by hfmuehleisen »

bakugo wrote: post #4

> According to the npm statistics, nobody has downloaded these packages before they were deprecated Is this actually accurate? Packages with weekly downloads in the hundreds of thousands, yet in the 4+ hours that the malicious versions were up for, not a single person updated any of them to the latest patch release?

DuckDB maintainer here, thanks for flagging this. Indeed the npm stats are delayed. We will know in a day or so what the actual count was. In the meantime, I've removed that statement.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#19

Post by ebfe1 »

Is it just me who think this could have been prevented if npm admins put in some sort of cool off period to only allow new versions or packages to be downloaded after being published by "x" amount of hours? This way the npm maintainer would get notifications on their email and react immediately? And if it is urgent fix, perhaps there can be a process to allow npm admin to approve and bypass publication cool off period.

Disclaimer: I don't know enough of npm/nodejs community so I might be completely off the mark here

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#20

Post by belgattitude »

bakugo wrote: post #4

> According to the npm statistics, nobody has downloaded these packages before they were deprecated Is this actually accurate? Packages with weekly downloads in the hundreds of thousands, yet in the 4+ hours that the malicious versions were up for, not a single person updated any of them to the latest patch release?

[dead]
Post reply on HN