Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM flooded with malicious packages downloaded more than 86k times

arstechnica.com

Post reply on HN
Print view View original

221–230 of 308 posts

Re: NPM flooded with malicious packages downloaded more than 86k times

#221

Post by The_President »

noosphr wrote: post #59

A day ago I got down voted to hell for saying that the JavaScript ecosystem has rotted the minds of developers and any tools that emulate npm should be shunned as much as possible - they are not solutions, they are problems. I don't usually get to say 'I told you so' within 24 hours of a warning, but JS is special like that.

You ain't wrong. Now we have industries that built software using less valuable labor that does not need to understand the technical layers underneath the application development environment. Not unlike the experience of someone who started driving a few weeks before their driving test versus someone who has been driving since the age of six.

Re: NPM flooded with malicious packages downloaded more than 86k times

#222

Post by The_President »

cogman10 wrote: post #81
noosphr wrote: post #59

A day ago I got down voted to hell for saying that the JavaScript ecosystem has rotted the minds of developers and any tools that emulate npm should be shunned as much as possible - they are not solutions, they are problems. I don't usually get to say 'I told you so' within 24 hours of a warning, but JS is special like that.

There's nothing really specially about the JS ecosystem that creates this problem. Plenty of others could fall in the same way, including C++ (see xz). The problem is we've been coasting on an era where blind trust was good enough an programming was niche enough.

Lower barrier to entry - JS allows newbies to roll up on CodePen and see the result of code without understanding the execution environment.

Re: NPM flooded with malicious packages downloaded more than 86k times

#223

Post by The_President »

ghusto wrote: post #5

When people ask me what's so wrong with lowering the bar of entry for engineering, I point to things like this.

Engineering used as a title should be regulated in the software industry; it was always a title reserved for a role that requires accountability. In software, it became used so casually without legal restriction that full stack developers started using it.

Re: NPM flooded with malicious packages downloaded more than 86k times

#224

Post by TZubiri »

jwr wrote: post #206

I always wondered why people found it acceptable to just run npm on their systems for anything they do, and have it download anything on any build. Coming from "make" with repeatable and predictable builds, I was appalled that you run this thing and you have no idea what it will download and what it will produce. Could be something different the next time you run it! Who knows! I also found it bizarre that even for t…

'Npm install thing' is easier than programming or even auditing imported code.

Too lazy to write, too cheap to pay for it, that's half of open source.

Now what's going to dominate stackoverflow answers, thoughtful articles on how to program? Or gratis npm/uv installable libraries that hide the actual solution details in between tests and polyfills and readmes, that end up just download another dependency while contributing enough lines of code so that the author can safely put it in their resume and grift over the oss ecosystem to get a cushy 300k/yr job at an extended faang where they are in charge of an ad pixel tracker or yet another one of those wallet things that are just an IO proxy for money but they get to keep some comission if they spend enough money on ads to convince someone to use the thing once and then it becomes their main neo(not) bank* forever.

*for regulatory reasons we must not call it a bank, but it's a bank

Re: NPM flooded with malicious packages downloaded more than 86k times

#225

Post by graemep »

Havoc wrote: post #220
jwr wrote: post #206

I always wondered why people found it acceptable to just run npm on their systems for anything they do, and have it download anything on any build. Coming from "make" with repeatable and predictable builds, I was appalled that you run this thing and you have no idea what it will download and what it will produce. Could be something different the next time you run it! Who knows! I also found it bizarre that even for t…

The entire Front end dev seems like trust me bro Wild West to me. All feels like endless layers of duct tape. Which I guess in a way it is given the evolution of browsers

it seems a lot worse with NPM for some reason, but the underlying weaknesses apply to language package managers in general too.

Re: NPM flooded with malicious packages downloaded more than 86k times

#226

Post by graemep »

matheusmoreira wrote: post #216
crtasm wrote: post #4

>When you run npm install, npm doesn't just download packages. It executes code. Specifically, it runs lifecycle scripts defined in package.json - preinstall, install, and postinstall hooks. What's the legitimate use case for a package install being allowed to run arbitrary commands on your computer? Quote is from the researchers report https://www.koi.ai/blog/phantomraven-npm-malware-hidden-in-i... edit: I was think…

There's nothing inherently wrong with that. The problem is npm allows any random person to upload packages. It's completely untrusted. Contrast that with Linux distributions which have actual maintainers who take responsibility for their packages. They don't generally allow malware to make it into the official software repositories. In many cases they went as far as meeting each other in person just to set up a decen…

Even when random people are allowed to contribute (AUR, PPAs) there seems to be more scrutiny and fewer incidents. Possibly because they are secondary to the main repos and possibly because the people who use them are made aware of the risks.

NPM etc. are a bit like Arch would be if everything was in AUR.

Re: NPM flooded with malicious packages downloaded more than 86k times

#227

Post by augusto-moura »

jwr wrote: post #206

I always wondered why people found it acceptable to just run npm on their systems for anything they do, and have it download anything on any build. Coming from "make" with repeatable and predictable builds, I was appalled that you run this thing and you have no idea what it will download and what it will produce. Could be something different the next time you run it! Who knows! I also found it bizarre that even for t…

Downloading things that you don't know about its common for every modern package manager out there, from maven, to nuget, to pip and npm. This is the new norm and there are reasons for it.

I don't think the old C/C++ way of relying on distro package managers would allow for the fast ecosystems people work nowadays.

Things are changing though, and people are pushing for more secure package managers with the same feature set as the old ones, which is possible.

I think this is the missing piece on the first wondering part of your comment. But I don't think we should be bashing the means without understanding the reasons

Re: NPM flooded with malicious packages downloaded more than 86k times

#228

Post by augusto-moura »

Havoc wrote: post #220
jwr wrote: post #206

I always wondered why people found it acceptable to just run npm on their systems for anything they do, and have it download anything on any build. Coming from "make" with repeatable and predictable builds, I was appalled that you run this thing and you have no idea what it will download and what it will produce. Could be something different the next time you run it! Who knows! I also found it bizarre that even for t…

The entire Front end dev seems like trust me bro Wild West to me. All feels like endless layers of duct tape. Which I guess in a way it is given the evolution of browsers

This is true for every moser package manager out there: pip, cargo, gradle and the lot. It is not about front end dev

Re: NPM flooded with malicious packages downloaded more than 86k times

#229

Post by graemep »

fragmede wrote: post #110
ab_testing wrote: post #108

Given the recent npm attacks, is it even safe to develop using npm. Whenever I start a react project, it downloads hundreds of additional packages which I have mo idea about what they do. As a developer who has learnt programming as a hobby, is it better to stick to some other safe ways to develop front end like thyme leaf or plain js or something else. When I build backend in flask or Django, I specifically type the…

Just a heads up that Pypi isn't immune from the same attack, with "Pypi supply chain attack" into Google revealing a (much smaller) number of packages that turned out to be malware. Some were not misspellings either, with one being a legitimate package that got hacked via GitHub Actions and a malicious payload added to the otherwise legitimate package.

Definitely, and you should be aware of the risk and think about and assess your dependencies.

Having a large standard library does reduce the number of dependencies, and you can go a long way using only well known dependencies.

Re: NPM flooded with malicious packages downloaded more than 86k times

#230

Post by graemep »

650REDHAIR wrote: post #10

As a hobbyist how do I stay protected and in the loop for breaches like this? I often follow guides that are popular and written by well-respected authors and I might be too flippant with installing dependencies trying to solve a pain point that has derailed my original project. Somewhat related, I also have a small homelab running local services and every now and then I try a new technology. occasionally I’ll build…

Running things in containers and VMs reduces the damage. One service on your homelab being compromised is a lot better than your entire homelab server getting compromised.

Neither is a security guarantee, but it does add a substantial extra barrier.

Post reply on HN