Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM flooded with malicious packages downloaded more than 86k times

arstechnica.com

Post reply on HN
Print view View original

31–40 of 308 posts

Re: NPM flooded with malicious packages downloaded more than 86k times

#31

Post by interstice »

crtasm wrote: post #4

>When you run npm install, npm doesn't just download packages. It executes code. Specifically, it runs lifecycle scripts defined in package.json - preinstall, install, and postinstall hooks. What's the legitimate use case for a package install being allowed to run arbitrary commands on your computer? Quote is from the researchers report https://www.koi.ai/blog/phantomraven-npm-malware-hidden-in-i... edit: I was think…

Notable times this has bitten me include compiling image compression tools for gulp and older versions of sass, oh and a memorable one with openssl. Downloading a npm package should ideally not also require messing around with c compilation tools.

Re: NPM flooded with malicious packages downloaded more than 86k times

#32

Post by [deleted] »

numbsafari wrote: post #27
650REDHAIR wrote: post #10

As a hobbyist how do I stay protected and in the loop for breaches like this? I often follow guides that are popular and written by well-respected authors and I might be too flippant with installing dependencies trying to solve a pain point that has derailed my original project. Somewhat related, I also have a small homelab running local services and every now and then I try a new technology. occasionally I’ll build…

Don't do development on your local machine. Full stop. Just don't. Do development, all of it, inside VMs or containers, either local or remote. Use ephemeral credentials within said VMs, or use no credentials. For example, do all your git pulls on your laptop directly, or in a separate VM with a mounted volume that is then shared with the VM/containers where you are running dev tooling. This has the added benefit of…

[deleted]

Re: NPM flooded with malicious packages downloaded more than 86k times

#33

Post by SoftTalker »

anthk wrote: post #13
cxr wrote: post #7

Imagine if we had a system where you could just deposit the source code for a program you work on into a "depository". You could set it up so your team could "admit" the changes that have your approval, but it doesn't allow third parties to modify what's in your depository (even if it's a library that you're using that they wrote). When you build/deploy your program, you only compile/run third-party versions that hav…

You are describing BSD ports from the 90's. FreeBSD ports date back to 1993.

And today.

Re: NPM flooded with malicious packages downloaded more than 86k times

#34

Post by chrisweekly »

squidsoup wrote: post #8
crtasm wrote: post #4

>When you run npm install, npm doesn't just download packages. It executes code. Specifically, it runs lifecycle scripts defined in package.json - preinstall, install, and postinstall hooks. What's the legitimate use case for a package install being allowed to run arbitrary commands on your computer? Quote is from the researchers report https://www.koi.ai/blog/phantomraven-npm-malware-hidden-in-i... edit: I was think…

pnpm v10 disables all lifecycle scripts by default and requires the user to whitelist packages. https://github.com/orgs/pnpm/discussions/8945

One of the many reasons there is no good reason to use npm; pnpm is better in every way.

Re: NPM flooded with malicious packages downloaded more than 86k times

#35

Post by sroussey »

squidsoup wrote: post #8
crtasm wrote: post #4

>When you run npm install, npm doesn't just download packages. It executes code. Specifically, it runs lifecycle scripts defined in package.json - preinstall, install, and postinstall hooks. What's the legitimate use case for a package install being allowed to run arbitrary commands on your computer? Quote is from the researchers report https://www.koi.ai/blog/phantomraven-npm-malware-hidden-in-i... edit: I was think…

pnpm v10 disables all lifecycle scripts by default and requires the user to whitelist packages. https://github.com/orgs/pnpm/discussions/8945

It’s just security theater in the end. You can just as easily put all that stuff in the package files since a package is installed to run code. You have that code then do all the sketchy stuff.

What’s needed is an entitlements system so a package you install doesn’t do runtime stuff like install crypto mining software. Even then…

Re: NPM flooded with malicious packages downloaded more than 86k times

#36

Post by cxr »

chrisweekly wrote: post #15
cxr wrote: post #7

Imagine if we had a system where you could just deposit the source code for a program you work on into a "depository". You could set it up so your team could "admit" the changes that have your approval, but it doesn't allow third parties to modify what's in your depository (even if it's a library that you're using that they wrote). When you build/deploy your program, you only compile/run third-party versions that hav…

You're describing a custom registry. These exist IRL (eg jFrog Artifactory). Useful for managing allow-listed packages which have met whatever criteria you might have (eg CVE-free based on your security tool of choice). Use of a custom registry, and a sane package manager (pnpm, not npm), and its lockfile, will significantly enhance your supply-chain security.

No. I am literally describing bog standard use of an ordinary VCS/SCM where the code for e.g. Skia, sqlite, libpng, etc. is placed in a "third-party/" subdirectory. Except I'm deliberately using the words "admit" and "depository" here instead of "commit" and "repository" in keeping with the theme—of the widespread failure of people to use SCMs to manage the corresponding source code required to build their product/project.

Overlay version control systems like NPM, Cargo, etc. and their harebrained schemes involving "lockfiles" to paper over their deficiencies have evidently totally destroyed not just folks' ability to conceive of just using an SCM like Git or Mercurial to manage source the way that they're made for without introducing a second, half-assed, "registry"-dependent VCS into the mix, but also destroyed the ability to recognize when a comment on the subject is dripping in the most obvious, easily detectable irony.

Re: NPM flooded with malicious packages downloaded more than 86k times

#37

Post by suck-my-spez »

numbsafari wrote: post #27
650REDHAIR wrote: post #10

As a hobbyist how do I stay protected and in the loop for breaches like this? I often follow guides that are popular and written by well-respected authors and I might be too flippant with installing dependencies trying to solve a pain point that has derailed my original project. Somewhat related, I also have a small homelab running local services and every now and then I try a new technology. occasionally I’ll build…

Don't do development on your local machine. Full stop. Just don't. Do development, all of it, inside VMs or containers, either local or remote. Use ephemeral credentials within said VMs, or use no credentials. For example, do all your git pulls on your laptop directly, or in a separate VM with a mounted volume that is then shared with the VM/containers where you are running dev tooling. This has the added benefit of…

Are people actually using UTM to do local development?

Im genuinely curious because I casually looked into it so that i could work on some hobby stuff over lunch on my work machine.

However I just assumed the performance wouldn't be too great.

Would love to hear how people are setup…

Re: NPM flooded with malicious packages downloaded more than 86k times

#38

Post by DyslexicAtheist »

numbsafari wrote: post #27
650REDHAIR wrote: post #10

As a hobbyist how do I stay protected and in the loop for breaches like this? I often follow guides that are popular and written by well-respected authors and I might be too flippant with installing dependencies trying to solve a pain point that has derailed my original project. Somewhat related, I also have a small homelab running local services and every now and then I try a new technology. occasionally I’ll build…

Don't do development on your local machine. Full stop. Just don't. Do development, all of it, inside VMs or containers, either local or remote. Use ephemeral credentials within said VMs, or use no credentials. For example, do all your git pulls on your laptop directly, or in a separate VM with a mounted volume that is then shared with the VM/containers where you are running dev tooling. This has the added benefit of…

[flagged]

Re: NPM flooded with malicious packages downloaded more than 86k times

#39

Post by gbransgrove »

Because these are fetching dependencies in the lifecycle hooks, even if they are legitimate at the moment there is no guarantee that it will stay that way. The owner of those dependencies could get compromised, or themselves be malicious, or be the package owner waiting to flip the switch to make existing versions become malicious. It's hard to see how the lifecycle hooks on install can stay in their current form.

Re: NPM flooded with malicious packages downloaded more than 86k times

#40

Post by theodorejb »

sroussey wrote: post #35
squidsoup wrote: post #8

Earlier quoted context omitted.

pnpm v10 disables all lifecycle scripts by default and requires the user to whitelist packages. https://github.com/orgs/pnpm/discussions/8945

It’s just security theater in the end. You can just as easily put all that stuff in the package files since a package is installed to run code. You have that code then do all the sketchy stuff. What’s needed is an entitlements system so a package you install doesn’t do runtime stuff like install crypto mining software. Even then…

I would expect to be able to download a package and then inspect the code before I decide to import/run any of the package files. But npm by default will run arbitrary code in the package before developers have a chance to inspect it, which can be very surprising and dangerous.
Post reply on HN