Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

github.com

Post reply on HN
Print view View original

31–40 of 296 posts

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#31

Post by skeeter2020 »

arewethereyeta wrote: post #9
OtherShrezzing wrote: post #8

Earlier quoted context omitted.

The attacker emailed a maintainer from a legitimate looking email address. The maintainer clicked the link and reset their credentials on a legitimate looking website. The attacker then signs into the legitimate duckdb account and publishes their new package. This is the second high-profile instance of the technique this week.

2FA for such high profile packages should be enforced

for popular packages - and in this case - they are. This attack (and yesterday's) are relay attacks, with the attacker in the middle between npm and the target.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#32

Post by vladvasiliu »

243423443 wrote: post #27
koakuma-chan wrote: post #23

Earlier quoted context omitted.

Passkey only works when you're on the correct website

Care to explain?

The actual URL in the browser is part of what the passkey signs. So if you go to totallynotascam.com which turns out to be some dude intercepting and passing the connection to npm, the signature would be refused by npm since it wouldn't be for the correct domain.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#33

Post by koakuma-chan »

diggan wrote: post #30
koakuma-chan wrote: post #23

Earlier quoted context omitted.

Passkey only works when you're on the correct website

Use a password manager (that isn't too buggy and/or suck) and you get the same thing for both TOTP and passwords.

Npm can't force people to use password manager

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#35

Post by koakuma-chan »

nodesocket wrote: post #34
koakuma-chan wrote: post #16

Should enforce passkeys not 2FA

I think just supporting yubikeys is sufficient.

I have two yubikeys lying around, how do I use them? I don't even have the correct hole in my laptop or in my phone to insert them

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#36

Post by r_lee »

skeeter2020 wrote: post #25
diggan wrote: post #12

So far, it seems to be a bog-standard phishing email, with not much novelty or sophistication, seems the people running the operation got very lucky with their victims though. I'm starting to think we haven't even seen the full scope of it yet, two authors confirmed as compromised, must be 10+ out there we haven't heard of yet?

>> So far, it seems to be a bog-standard phishing email The fact this is NOT the standard phishing email shows how low the bar is: 1. the text of the email reads like one you'd get from npm in the tone, format and lack of obvious spelling & grammatical errors. It pushes you to move quicker than you might normally, without triggering the typical suspicions. 2. the landing domain and website copy seem really close to l…

How does AI relate to this in any way? you can easily clone websites by just copying via devtools, like seriously

same with just copying email HTML

it's actually easier to make it looke exactly the same vs different in some ways

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#38

Post by eviks »

> This website contained a *pixel-perfect copy* of the npmjs.com website.

Not sure how this emphasis is of any importance, you brain doesn't have a pixel perfect image of the website, so you wouldn't know whether it's a perfect replica or not.

Let the silicon dummies in the password manager do the matching, don't strain your brain with such games outside of entertainment

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#40

Post by nodesocket »

koakuma-chan wrote: post #35
nodesocket wrote: post #34

Earlier quoted context omitted.

I think just supporting yubikeys is sufficient.

I have two yubikeys lying around, how do I use them? I don't even have the correct hole in my laptop or in my phone to insert them

This is a joke right? Can’t say I’ve ever heard of USB ports referred to as “holes”.
Post reply on HN