Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM flooded with malicious packages downloaded more than 86k times

arstechnica.com

Post reply on HN
Print view View original

161–170 of 308 posts

Re: NPM flooded with malicious packages downloaded more than 86k times

#161

Post by codedokode »

bandrami wrote: post #86
crtasm wrote: post #4

>When you run npm install, npm doesn't just download packages. It executes code. Specifically, it runs lifecycle scripts defined in package.json - preinstall, install, and postinstall hooks. What's the legitimate use case for a package install being allowed to run arbitrary commands on your computer? Quote is from the researchers report https://www.koi.ai/blog/phantomraven-npm-malware-hidden-in-i... edit: I was think…

OK but have you seen how many projects' official installation instructions are some form of curl | bash?

In most cases to use a library you just need to download files and place them into a directory.

Re: NPM flooded with malicious packages downloaded more than 86k times

#162

Post by hinkley »

numbsafari wrote: post #27
650REDHAIR wrote: post #10

As a hobbyist how do I stay protected and in the loop for breaches like this? I often follow guides that are popular and written by well-respected authors and I might be too flippant with installing dependencies trying to solve a pain point that has derailed my original project. Somewhat related, I also have a small homelab running local services and every now and then I try a new technology. occasionally I’ll build…

Don't do development on your local machine. Full stop. Just don't. Do development, all of it, inside VMs or containers, either local or remote. Use ephemeral credentials within said VMs, or use no credentials. For example, do all your git pulls on your laptop directly, or in a separate VM with a mounted volume that is then shared with the VM/containers where you are running dev tooling. This has the added benefit of…

I used to have a separate account on my box for doing code for other people, one for myself and another for surfing the web. Since I have an Apple TV hooked up to one of my monitors I don’t have a ton of reasons for hopping credentials between accounts so I think I’ll be going back to at least that.

The fact I use nvm means a global install won’t cross accounts.

Re: NPM flooded with malicious packages downloaded more than 86k times

#163

Post by jgtrosh »

codedokode wrote: post #155
scuff3d wrote: post #140

Earlier quoted context omitted.

One of the biggest things that pushes me away from Rust is the reliance on micro dependencies. It's a terrible model.

What's wrong with micro dependencies? Isn't it better to download only the code you need? Also it makes refactoring easier, and enforces better architecture.

Is this bait? The whole context is malicious software being installed en masse via NPM micro dependencies.

Re: NPM flooded with malicious packages downloaded more than 86k times

#164

Post by dns_snek »

bandrami wrote: post #86
crtasm wrote: post #4

>When you run npm install, npm doesn't just download packages. It executes code. Specifically, it runs lifecycle scripts defined in package.json - preinstall, install, and postinstall hooks. What's the legitimate use case for a package install being allowed to run arbitrary commands on your computer? Quote is from the researchers report https://www.koi.ai/blog/phantomraven-npm-malware-hidden-in-i... edit: I was think…

OK but have you seen how many projects' official installation instructions are some form of curl | bash?

Both post-install scripts and curl|bash scripts are just scapegoats of supply chain security with similar faulty reasoning.

Re: NPM flooded with malicious packages downloaded more than 86k times

#165

Post by willtemperley »

cxr wrote: post #36
chrisweekly wrote: post #15

Earlier quoted context omitted.

You're describing a custom registry. These exist IRL (eg jFrog Artifactory). Useful for managing allow-listed packages which have met whatever criteria you might have (eg CVE-free based on your security tool of choice). Use of a custom registry, and a sane package manager (pnpm, not npm), and its lockfile, will significantly enhance your supply-chain security.

No. I am literally describing bog standard use of an ordinary VCS/SCM where the code for e.g. Skia, sqlite, libpng, etc. is placed in a "third-party/" subdirectory. Except I'm deliberately using the words "admit" and "depository" here instead of "commit" and "repository" in keeping with the theme—of the widespread failure of people to use SCMs to manage the corresponding source code required to build their product/pr…

This is exactly what Swift Package Manager does. No drama in the Swift Package world AFAIK.

Re: NPM flooded with malicious packages downloaded more than 86k times

#166

Post by silverwind »

ashishb wrote: post #58

Here's my `npm` command these days. It reduces the attack surface drastically. alias npm='docker run --rm -it -v ${PWD}:${PWD} --net=host --workdir=${PWD} node:25-bookworm-slim npm' - No access to my env vars - No access to anything outside my current directory (usually a JS project). - No access to my .bashrc or other files. Ref: https://ashishb.net/programming/run-tools-inside-docker/

This will break native dependencies when the host platform is not the same as the container platform.

Re: NPM flooded with malicious packages downloaded more than 86k times

#167

Post by silverwind »

ab_testing wrote: post #108

Given the recent npm attacks, is it even safe to develop using npm. Whenever I start a react project, it downloads hundreds of additional packages which I have mo idea about what they do. As a developer who has learnt programming as a hobby, is it better to stick to some other safe ways to develop front end like thyme leaf or plain js or something else. When I build backend in flask or Django, I specifically type the…

All package ecosystems that allow unvetted code being published are affected, it just happens that npm is by far the most popular one, so it gets all the news.

Re: NPM flooded with malicious packages downloaded more than 86k times

#168

Post by klabb3 »

socalgal2 wrote: post #111
ab_testing wrote: post #108

Given the recent npm attacks, is it even safe to develop using npm. Whenever I start a react project, it downloads hundreds of additional packages which I have mo idea about what they do. As a developer who has learnt programming as a hobby, is it better to stick to some other safe ways to develop front end like thyme leaf or plain js or something else. When I build backend in flask or Django, I specifically type the…

It's no different anywhere else. I just downloaded jj (rust), it installed 470+ packages When I downloaded wan2gp (python) it installed it install 211 packages.

> It's no different anywhere else.

But it is. Both C/C++ and Go are not at all like this.

I don’t know about Python but Rust ecosystem tends attract enthusiasts who make good single purpose packages but that are abandoned because maintainers move on, or sometimes forked due to minor disagreements similar to how Linux/unix is fragmented with tribal feuds.

Re: NPM flooded with malicious packages downloaded more than 86k times

#170

Post by jraph »

codedokode wrote: post #155
scuff3d wrote: post #140

Earlier quoted context omitted.

One of the biggest things that pushes me away from Rust is the reliance on micro dependencies. It's a terrible model.

What's wrong with micro dependencies? Isn't it better to download only the code you need? Also it makes refactoring easier, and enforces better architecture.

Dependency management is work. And almost nobody does this work seriously because it has become unrealistic to do, which is the big concern here.

You now have to audit the hundreds of dependencies. Each time you upgrade them.

Rust is compiled and source code doesn't weigh that much, you could have the compiler remove dead code.

And sometimes it's just better to review and then copy paste small utility functions once.

Post reply on HN