Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM flooded with malicious packages downloaded more than 86k times

arstechnica.com

Post reply on HN
Print view View original

81–90 of 308 posts

Re: NPM flooded with malicious packages downloaded more than 86k times

#81

Post by cogman10 »

noosphr wrote: post #59

A day ago I got down voted to hell for saying that the JavaScript ecosystem has rotted the minds of developers and any tools that emulate npm should be shunned as much as possible - they are not solutions, they are problems. I don't usually get to say 'I told you so' within 24 hours of a warning, but JS is special like that.

There's nothing really specially about the JS ecosystem that creates this problem. Plenty of others could fall in the same way, including C++ (see xz).

The problem is we've been coasting on an era where blind trust was good enough an programming was niche enough.

Re: NPM flooded with malicious packages downloaded more than 86k times

#82

Post by ChrisMarshallNY »

crtasm wrote: post #4

>When you run npm install, npm doesn't just download packages. It executes code. Specifically, it runs lifecycle scripts defined in package.json - preinstall, install, and postinstall hooks. What's the legitimate use case for a package install being allowed to run arbitrary commands on your computer? Quote is from the researchers report https://www.koi.ai/blog/phantomraven-npm-malware-hidden-in-i... edit: I was think…

Swift Package Manager[0] executes a Swift script. The Package.swift file[1] (the manifest) is actually an executed source file.

I assume that it's heavily sandboxed, though, so it may be difficult to leverage.

[0] https://docs.swift.org/swiftpm/documentation/packagemanagerd...

[1] https://developer.apple.com/documentation/packagedescription

Re: NPM flooded with malicious packages downloaded more than 86k times

#83

Post by nkrisc »

SoftTalker wrote: post #60
exe34 wrote: post #17

Earlier quoted context omitted.

how hard would it be to say "upon first install, run do_sketchy_shit.sh to install requirements"?

But most users would do that without inspecting it at all, and a fair number would prefix it with “sudo” out of habit.

But that’s at least a conscious and explicit action the user chooses to make and is explicitly aware of making.

Re: NPM flooded with malicious packages downloaded more than 86k times

#85

Post by madeofpalk »

vorticalbox wrote: post #9
crtasm wrote: post #4

>When you run npm install, npm doesn't just download packages. It executes code. Specifically, it runs lifecycle scripts defined in package.json - preinstall, install, and postinstall hooks. What's the legitimate use case for a package install being allowed to run arbitrary commands on your computer? Quote is from the researchers report https://www.koi.ai/blog/phantomraven-npm-malware-hidden-in-i... edit: I was think…

One use case is downloading of binaries. For example mongo-memory-server [0] will download the mongoDB binary after you have installed it. [0] https://www.npmjs.com/package/mongodb-memory-server

And now optional dependencies negate the need for this. Your package manager can just download platform-specific binaries automatically https://docs.npmjs.com/cli/v7/configuring-npm/package-json#o...

Re: NPM flooded with malicious packages downloaded more than 86k times

#86

Post by bandrami »

crtasm wrote: post #4

>When you run npm install, npm doesn't just download packages. It executes code. Specifically, it runs lifecycle scripts defined in package.json - preinstall, install, and postinstall hooks. What's the legitimate use case for a package install being allowed to run arbitrary commands on your computer? Quote is from the researchers report https://www.koi.ai/blog/phantomraven-npm-malware-hidden-in-i... edit: I was think…

OK but have you seen how many projects' official installation instructions are some form of curl | bash?

Re: NPM flooded with malicious packages downloaded more than 86k times

#87

Post by bandrami »

ashishb wrote: post #75
phiresky wrote: post #68

Earlier quoted context omitted.

That seems a bit excessive to sandbox a command that really just downloads arbitrary code you are going to execute immediately afterwards anyways? Also I can recommend pnpm, it has stopped executing lifecycle scripts by default so you can whitelist which ones to run.

> That seems a bit excessive to sandbox a command that really just downloads arbitrary code you are going to execute immediately afterwards anyways? I won't execute that code directly on my machine. I will always execute it inside the Docker container. Why do you want to run commands like `vite` or `eslint` directly on your machine? Why do they need access to anything outside the current directory?

I get this but then in practice the only actually valuable stuff on my computer is... the code and data in my dev containers. Everything else I can download off the Internet for free at any time.

Re: NPM flooded with malicious packages downloaded more than 86k times

#88

Post by apsurd »

ashishb wrote: post #75
phiresky wrote: post #68

Earlier quoted context omitted.

That seems a bit excessive to sandbox a command that really just downloads arbitrary code you are going to execute immediately afterwards anyways? Also I can recommend pnpm, it has stopped executing lifecycle scripts by default so you can whitelist which ones to run.

> That seems a bit excessive to sandbox a command that really just downloads arbitrary code you are going to execute immediately afterwards anyways? I won't execute that code directly on my machine. I will always execute it inside the Docker container. Why do you want to run commands like `vite` or `eslint` directly on your machine? Why do they need access to anything outside the current directory?

it annoys me that people fully automate things like type checkers and linting into post commit or worse entirely outsourced to CI.

Because it means the hygiene is thrown over the fence in a post commit manner.

AI makes this worse because they also run them "over the fence".

However you run it, i want a human to hold accountability for the mainline committed code.

Re: NPM flooded with malicious packages downloaded more than 86k times

#89

Post by hombre_fatal »

SoftTalker wrote: post #60
exe34 wrote: post #17

Earlier quoted context omitted.

how hard would it be to say "upon first install, run do_sketchy_shit.sh to install requirements"?

But most users would do that without inspecting it at all, and a fair number would prefix it with “sudo” out of habit.

That's fine, and it's still better than doing it on install.

Re: NPM flooded with malicious packages downloaded more than 86k times

#90

Post by cyphar »

exe34 wrote: post #17
j1elo wrote: post #6

Earlier quoted context omitted.

Easy example that I know of: the Mediasoup project is a library written in C++ for streaming video over the internet. It is published as a Node package and offers a JS API. Upon installing, it would just download the appropriate C++ sources and compile them on the spot. The project maintainers wanted to write code, not manage precompiled builds, so that was the most logical way of installing it. Note that a while ago…

how hard would it be to say "upon first install, run do_sketchy_shit.sh to install requirements"?

rpm and dpkg both provide mechanisms to run scripts on user machines (usually used to configure users and groups on the user machine), so this aspect is not an NPM-specific. Rust has the same thing with build.rs (which is necessary to find shared C libraries for crates that link with them) so there is a legitimate need for this that would be hard to eliminate.

Personally, I think the issue is that it is too easy to create packages that people can then pull too easily. rpm and dpkg are annoying to write for most people and require some kind of (at least cursory) review before they can be installed on user's systems from the default repos. Both of these act as barriers against the kinds of lazy attacks we've seen in the past few months. Of course, no language package registry has the bandwidth to do that work, so Wild West it is!

Post reply on HN