Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

socket.dev

Post reply on HN
Print view View original

991–1000 of 1001 posts

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#991

Post by [deleted] »

singulasar wrote: post #985
kjok wrote: post #983

Earlier quoted context omitted.

> on the other hand, the previous supply chain attack was found by automated tech. Are you sure about this? Would love to see which ones.

The chalk/debug one https://www.aikido.dev/blog/npm-debug-and-chalk-packages-com... I believe socket also found it this way just a bit later. The dev later said that Charlie notifying him probably shaved off some very important time for the remediation. So in this case 2 different companies found it using automated tech before anyone else

[deleted]

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#992

Post by CharlieEriksen »

singulasar wrote: post #985
kjok wrote: post #983

Earlier quoted context omitted.

> on the other hand, the previous supply chain attack was found by automated tech. Are you sure about this? Would love to see which ones.

The chalk/debug one https://www.aikido.dev/blog/npm-debug-and-chalk-packages-com... I believe socket also found it this way just a bit later. The dev later said that Charlie notifying him probably shaved off some very important time for the remediation. So in this case 2 different companies found it using automated tech before anyone else

Hi, I'm Charlie from Aikido, as mentioned above. Yes, we detected it automatically, and I alerted Josh to the situation on BSky.

There's no reason why Microsoft/npm can't do what we're doing, or any of the other handful to dozen companies that do similar things to us, to protect the supply chain.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#993

Post by user3939382 »

bleuarff wrote: post #885
user3939382 wrote: post #877

Earlier quoted context omitted.

I don’t recall hearing about constant supply chain attacks with CPAN

Because it's never been considered an interesting target, compared to npm's reach?

For a while CPAN was a very big deal and those packages were probably on just about every corporate network on Earth.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#994

Post by fennecfoxy »

Meneth wrote: post #91

This happens because there's no auditing of new packages or versions. The distro's maintainer and the developer is the same person. The general solution is to do what Debian does. Keep a stable distro where new packages aren't added and versions change rarely (security updates and bugfixes only, no new functionality). This is what most people use. Keep a testing/unstable distro where new packages and new versions can…

Pretty unfeasible with the variety of packages/ecosystems that get created. You'd either ending up requiring a LOT of dev time looking over packages on the maintainer end, or basically having no packages people need to use in your repository.

Finding the balance of that seems to me like it'd be incredibly difficult.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#995

Post by fennecfoxy »

ncruces wrote: post #381
Meneth wrote: post #91

This happens because there's no auditing of new packages or versions. The distro's maintainer and the developer is the same person. The general solution is to do what Debian does. Keep a stable distro where new packages aren't added and versions change rarely (security updates and bugfixes only, no new functionality). This is what most people use. Keep a testing/unstable distro where new packages and new versions can…

This is a culture issue with developers who find it OK to have hundreds of (transitive) dependencies, and then follow processes that, for all intents and purposes, blindly auto update them, thereby giving hundreds of third-parties access to their build (or worse) execution environments. Adding friction to the sharing of code doesn't absolve developers from their decision to blindly trust a ridiculous amount of third-…

>absolve developers

Doesn't this ultimately go all the way up to the top?

You have 2 devs: one who mostly writes their own code, only uses packages that are audited etc; the other uses packages willy nilly. Who do you think will be hired? Who do you think will be able to match the pace of development that management and executives demand?

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#996

Post by fennecfoxy »

snickerbockers wrote: post #774

I try to stay as far from web development as possible in my programming career (kernel/drivers and most recently reverse engineering) so maybe I'm ill-informed here but this npm thing seems to be uniquely terrible at security and i cannot fathom why the entire web seems to be automatically downloading updates from it and pushing them into production with no oversight. I've always worked at companies where we use thir…

Velocity and the pursuit of higher numbers for the shareholders yoy; endless growth!

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#997

Post by fennecfoxy »

lithos wrote: post #83
zachrip wrote: post #38

Earlier quoted context omitted.

I can tell a lot about a dev by the fact that they single out npm/js for this supply chain issue.

Just more engineering leaning than you. Actual engineers have to analyze their supply chains, and so makes sense they would be baffled by NPM dependency trees that utterly normal projects grow into in the JavaScript ecosystem.

Ah yes, this old way of thinking. Bro we live in a world where at least in web (and plenty of other domains) the velocity demanded from developers is exceedingly high; not necessarily because that's what those developers want, but because that's what management wants.

Most of my career Node.JS has paid the bills and I'm very grateful to fate for that; but I have also worked in C/asm/etc for embedded firmware etc. Implying that the JS ecosystem is only comprised of terrible devs is classic gatekeeping holier than thou type shit.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#998

Post by jddj »

yawaramin wrote: post #734
jddj wrote: post #51

Earlier quoted context omitted.

Is the difference between the number of dev dependencies for eg. VueJs (a JavaScript library for marshalling Json Ajax responses into UI) and Htmx (a JavaScript library for marshalling html Ajax responses into UI) meaningful? There is a difference, but it's not an order of magnitude and neither is a true island. Granted, deciding not to use JS on the server is reasonable in the context of this article, but for the cl…

Except that htmx's recommended usage is as a single injected directly into your HTML page, not as an npm dependency. So unless you are an htmx contributor you are not going to be installing the dev dependencies.

That script still gets built somewhere using those deps

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#999

Post by hoppp »

bigstrat2003 wrote: post #968
hoppp wrote: post #135

Earlier quoted context omitted.

Lucky you. I keep coming back to it because jobs and even for desktop apps a native webview beats everything else. We fcked up with js, big time and its with us forever now

A webview doesn't beat anything for desktop apps. It is the worst option available.

A go desktop app with native webview: 3.3 MB starting size

A go desktop app rendered with OpenGL: 39MB starting size

So its smaller than Gpu rendered desktop app and I get to use CSS for styling which is very powerful

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#1000

Post by myroon5 »

amai wrote: post #865
paulirish wrote: post #257

This vulnerability was reported to NPM in 2016: https://blog.npmjs.org/post/141702881055/package-install-scr... https://www.kb.cert.org/vuls/id/319816 but the NPM response was WAI.

NPM belongs to Microsoft. What do you expect?

NPM was acquired 4 years after that post
Post reply on HN