Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM flooded with malicious packages downloaded more than 86k times

arstechnica.com

Post reply on HN
Print view View original

91–100 of 308 posts

Re: NPM flooded with malicious packages downloaded more than 86k times

#91

Post by throwaway290 »

ashishb wrote: post #75
phiresky wrote: post #68

Earlier quoted context omitted.

That seems a bit excessive to sandbox a command that really just downloads arbitrary code you are going to execute immediately afterwards anyways? Also I can recommend pnpm, it has stopped executing lifecycle scripts by default so you can whitelist which ones to run.

> That seems a bit excessive to sandbox a command that really just downloads arbitrary code you are going to execute immediately afterwards anyways? I won't execute that code directly on my machine. I will always execute it inside the Docker container. Why do you want to run commands like `vite` or `eslint` directly on your machine? Why do they need access to anything outside the current directory?

It's weird that it's downvoted because this is the way

Re: NPM flooded with malicious packages downloaded more than 86k times

#92

Post by userbinator »

jtokoph wrote: post #80

Keep in mind that the vast majority of the 86,000 downloads are probably automated downloads by tools looking for malicious code, or other malicious tools pulling every new package version looking for leaked credentials. When I iterate with new versions of a package that I’ve never promoted anywhere, each version gets hundreds of downloads in the first day or two of being published. 86,000 people did not get pwnd, po…

Or it's some poor idiot's CI repeatedly downloading them, and for a zombie project that no one will ever use.

Re: NPM flooded with malicious packages downloaded more than 86k times

#94

Post by apsurd »

throwaway290 wrote: post #91
ashishb wrote: post #75

Earlier quoted context omitted.

> That seems a bit excessive to sandbox a command that really just downloads arbitrary code you are going to execute immediately afterwards anyways? I won't execute that code directly on my machine. I will always execute it inside the Docker container. Why do you want to run commands like `vite` or `eslint` directly on your machine? Why do they need access to anything outside the current directory?

It's weird that it's downvoted because this is the way

maybe i'm misunderstanding the "why run anything on my machine" part. is the container on the machine? isn't that running things on your machine?

is he just saying always run your code in a container?

Re: NPM flooded with malicious packages downloaded more than 86k times

#95

Post by hombre_fatal »

suck-my-spez wrote: post #37
numbsafari wrote: post #27

Earlier quoted context omitted.

Don't do development on your local machine. Full stop. Just don't. Do development, all of it, inside VMs or containers, either local or remote. Use ephemeral credentials within said VMs, or use no credentials. For example, do all your git pulls on your laptop directly, or in a separate VM with a mounted volume that is then shared with the VM/containers where you are running dev tooling. This has the added benefit of…

Are people actually using UTM to do local development? Im genuinely curious because I casually looked into it so that i could work on some hobby stuff over lunch on my work machine. However I just assumed the performance wouldn't be too great. Would love to hear how people are setup…

I started using UTM last week on my Macbook just to try out NixOS + sway and see if I could make environment that I liked using (inspired by the hype around Omarchy).

Pretty soon I liked using the environment so much that I got my work running on it. And when I change the environment, I can sync it to my other machine.

Though NixOS is particularly magical as a dev environment since you have a record of everything you've done. Every time I mess with postgres hb_conf or nginx or pcap or on my local machine, I think "welp, I'll never remember that I did that".

Re: NPM flooded with malicious packages downloaded more than 86k times

#96

Post by BobbyTables2 »

akagusu wrote: post #93

Unpopular opinion: why not reduce the dependency on 3rd party packages? Why not reduce the number of dependencies so you can know what code you are using?

I’ve wondered this for so long, I questioned my own sanity.

Re: NPM flooded with malicious packages downloaded more than 86k times

#97

Post by minitech »

apsurd wrote: post #94
throwaway290 wrote: post #91

Earlier quoted context omitted.

It's weird that it's downvoted because this is the way

maybe i'm misunderstanding the "why run anything on my machine" part. is the container on the machine? isn't that running things on your machine? is he just saying always run your code in a container?

> is the container on the machine?

> is he just saying always run your code in a container?

yes

> isn't that running things on your machine?

in this context where they're explicitly contrasted, it isn't running things "directly on my machine"

Re: NPM flooded with malicious packages downloaded more than 86k times

#98

Post by bigstrat2003 »

numbsafari wrote: post #27
650REDHAIR wrote: post #10

As a hobbyist how do I stay protected and in the loop for breaches like this? I often follow guides that are popular and written by well-respected authors and I might be too flippant with installing dependencies trying to solve a pain point that has derailed my original project. Somewhat related, I also have a small homelab running local services and every now and then I try a new technology. occasionally I’ll build…

Don't do development on your local machine. Full stop. Just don't. Do development, all of it, inside VMs or containers, either local or remote. Use ephemeral credentials within said VMs, or use no credentials. For example, do all your git pulls on your laptop directly, or in a separate VM with a mounted volume that is then shared with the VM/containers where you are running dev tooling. This has the added benefit of…

That's not a realistic solution. Nobody is going to stop using their machine for development just to get some security gains, it's way too much of a pain to do that.

Re: NPM flooded with malicious packages downloaded more than 86k times

#99

Post by ashishb »

apsurd wrote: post #88
ashishb wrote: post #75

Earlier quoted context omitted.

> That seems a bit excessive to sandbox a command that really just downloads arbitrary code you are going to execute immediately afterwards anyways? I won't execute that code directly on my machine. I will always execute it inside the Docker container. Why do you want to run commands like `vite` or `eslint` directly on your machine? Why do they need access to anything outside the current directory?

it annoys me that people fully automate things like type checkers and linting into post commit or worse entirely outsourced to CI. Because it means the hygiene is thrown over the fence in a post commit manner. AI makes this worse because they also run them "over the fence". However you run it, i want a human to hold accountability for the mainline committed code.

I run linters like eslint on my machine inside a container. This reduces attack surface.

How does this throw hygiene over the fence?

Re: NPM flooded with malicious packages downloaded more than 86k times

#100

Post by bitbasher »

ashishb wrote: post #58

Here's my `npm` command these days. It reduces the attack surface drastically. alias npm='docker run --rm -it -v ${PWD}:${PWD} --net=host --workdir=${PWD} node:25-bookworm-slim npm' - No access to my env vars - No access to anything outside my current directory (usually a JS project). - No access to my .bashrc or other files. Ref: https://ashishb.net/programming/run-tools-inside-docker/

There are so many vectors for this attack to piggyback off from.

If I had malicious intentions, I would probably typo squat popular plugins/lsps that will execute code automatically when their editor runs. A compromised neovim or vscode gives you plenty of user permissions, a full scripting language, ability to do http calls, system calls, etc. Most LSPs are installed globally, doesn't matter if you downloaded it via a docker command.

Post reply on HN