Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM flooded with malicious packages downloaded more than 86k times

arstechnica.com

Post reply on HN
Print view View original

151–160 of 308 posts

Re: NPM flooded with malicious packages downloaded more than 86k times

#151

Post by lenkite »

j1elo wrote: post #6
crtasm wrote: post #4

>When you run npm install, npm doesn't just download packages. It executes code. Specifically, it runs lifecycle scripts defined in package.json - preinstall, install, and postinstall hooks. What's the legitimate use case for a package install being allowed to run arbitrary commands on your computer? Quote is from the researchers report https://www.koi.ai/blog/phantomraven-npm-malware-hidden-in-i... edit: I was think…

Easy example that I know of: the Mediasoup project is a library written in C++ for streaming video over the internet. It is published as a Node package and offers a JS API. Upon installing, it would just download the appropriate C++ sources and compile them on the spot. The project maintainers wanted to write code, not manage precompiled builds, so that was the most logical way of installing it. Note that a while ago…

Believe such build tools and processes should be run inside a container environment. Maybe once all OS have native, cheap and lean containers and permit dead simple container execution of scripts, this will be possible.

Re: NPM flooded with malicious packages downloaded more than 86k times

#152

Post by hinkley »

jtokoph wrote: post #80

Keep in mind that the vast majority of the 86,000 downloads are probably automated downloads by tools looking for malicious code, or other malicious tools pulling every new package version looking for leaked credentials. When I iterate with new versions of a package that I’ve never promoted anywhere, each version gets hundreds of downloads in the first day or two of being published. 86,000 people did not get pwnd, po…

When I published a library it got about 300 downloads a week for the first few and then dropped down to about 100. That would be a lot of weeks.

> Many of the dependencies used names that are known to be “hallucinated” by AI chatbots.

There’s more here than that.

Re: NPM flooded with malicious packages downloaded more than 86k times

#153

Post by codedokode »

I am surprised that anyone in this year runs scripts from random people from Github without sandboxing. As a wise proverb says, a peasant won't cross himself until the thunder bursts out. Spend a couple hours setting up a sandbox and be safer.

Re: NPM flooded with malicious packages downloaded more than 86k times

#154

Post by lelanthran »

ashishb wrote: post #58

Here's my `npm` command these days. It reduces the attack surface drastically. alias npm='docker run --rm -it -v ${PWD}:${PWD} --net=host --workdir=${PWD} node:25-bookworm-slim npm' - No access to my env vars - No access to anything outside my current directory (usually a JS project). - No access to my .bashrc or other files. Ref: https://ashishb.net/programming/run-tools-inside-docker/

Won't that still download malicious packages that are dep?

Re: NPM flooded with malicious packages downloaded more than 86k times

#155

Post by codedokode »

scuff3d wrote: post #140
socalgal2 wrote: post #111

Earlier quoted context omitted.

It's no different anywhere else. I just downloaded jj (rust), it installed 470+ packages When I downloaded wan2gp (python) it installed it install 211 packages.

One of the biggest things that pushes me away from Rust is the reliance on micro dependencies. It's a terrible model.

What's wrong with micro dependencies? Isn't it better to download only the code you need? Also it makes refactoring easier, and enforces better architecture.

Re: NPM flooded with malicious packages downloaded more than 86k times

#156

Post by hinkley »

socalgal2 wrote: post #116
650REDHAIR wrote: post #10

As a hobbyist how do I stay protected and in the loop for breaches like this? I often follow guides that are popular and written by well-respected authors and I might be too flippant with installing dependencies trying to solve a pain point that has derailed my original project. Somewhat related, I also have a small homelab running local services and every now and then I try a new technology. occasionally I’ll build…

(1) Start by not using packages that have stupid dependencies Any package that includes a CLI version in the library should have it's dev shamed. Usually that adds 10-20 packages. Those 2 things, a library that provides some functionality, and a CLI command that lets you use the library from the command line, SHOULD NEVER BE MIXED. The library should be its own package without the bloat of the command line crap (2) C…

> Any package that includes a CLI version in the library should have it's dev shamed. Usually that adds 10-20 packages.

After your little rant you point out Commander has zero dependencies. So I don’t know what’s up with you.

If the library you’re building has anything with application lifecycle, particularly bootstrapping, then having a CLI with one dependency is quite handy for triage. Most especially for talking someone else through triage when for instance I was out and there was a production issue.

Which is why half the modules I worked on at my last place ended up with a CLI. They are, as a rule, read mostly. Which generally doesn’t require an all caps warning.

Does every module need one of those? No. But if your module is meant as a devDependency, odds are good it might. And if it’s bootstrapping code, then it might as well.

> should have it's dev shamed

Oh I feel embarrassed right now. But not for me.

Re: NPM flooded with malicious packages downloaded more than 86k times

#157

Post by codedokode »

lenkite wrote: post #151
j1elo wrote: post #6

Earlier quoted context omitted.

Easy example that I know of: the Mediasoup project is a library written in C++ for streaming video over the internet. It is published as a Node package and offers a JS API. Upon installing, it would just download the appropriate C++ sources and compile them on the spot. The project maintainers wanted to write code, not manage precompiled builds, so that was the most logical way of installing it. Note that a while ago…

Believe such build tools and processes should be run inside a container environment. Maybe once all OS have native, cheap and lean containers and permit dead simple container execution of scripts, this will be possible.

Google's OS, Android, has sandboxes. It's some Linux problem that they do not want to backport it.

Re: NPM flooded with malicious packages downloaded more than 86k times

#158

Post by codedokode »

squidsoup wrote: post #8
crtasm wrote: post #4

>When you run npm install, npm doesn't just download packages. It executes code. Specifically, it runs lifecycle scripts defined in package.json - preinstall, install, and postinstall hooks. What's the legitimate use case for a package install being allowed to run arbitrary commands on your computer? Quote is from the researchers report https://www.koi.ai/blog/phantomraven-npm-malware-hidden-in-i... edit: I was think…

pnpm v10 disables all lifecycle scripts by default and requires the user to whitelist packages. https://github.com/orgs/pnpm/discussions/8945

Finally sane solution. When I was thinking about package manager design, I also thought that there should be no scripts, the package manager should just download files and that's all.

Re: NPM flooded with malicious packages downloaded more than 86k times

#159

Post by hinkley »

marcus_holmes wrote: post #106
650REDHAIR wrote: post #10

As a hobbyist how do I stay protected and in the loop for breaches like this? I often follow guides that are popular and written by well-respected authors and I might be too flippant with installing dependencies trying to solve a pain point that has derailed my original project. Somewhat related, I also have a small homelab running local services and every now and then I try a new technology. occasionally I’ll build…

Somewhat controversial these days, but treat every single dependency as a potential security nightmare, source of bugs, problem that you will have to solve in the future. Use dependencies carefully and as a last resort. Vendoring dependencies (copying the package code into your project rather than using the package manager to manage it) can help - it won't stop a malicious package, but it will stop a package from tur…

Local proxies that can work offline also helps. Though not as much as vendoring.

Re: NPM flooded with malicious packages downloaded more than 86k times

#160

Post by codedokode »

theodorejb wrote: post #43
squidsoup wrote: post #8

Earlier quoted context omitted.

pnpm v10 disables all lifecycle scripts by default and requires the user to whitelist packages. https://github.com/orgs/pnpm/discussions/8945

Bun also doesn't execute lifestyle scripts by default, except for a customizable whitelist of trusted dependencies: https://bun.com/docs/guides/install/trusted

"Trusted" dependencies are poor solution, the good solution is either never run scripts, or run them inside qemu.
Post reply on HN