NPM post-install scripts considered harmful.
There has to be a tool that allows you (or an AI) to easily review post-install scripts before you install the package.
Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem
21–30 of 191 posts
Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem
#22That’s weird, pnpm no longer automatically runs lifecycle scripts like preinstall [1], so unless they were running a very old version of pnpm, shouldn’t they have been protected from Shai-Hulud? 1: https://github.com/pnpm/pnpm/pull/8897
At the end of the article, they talk about how they've since updated to the latest major version of pnpm, which is the one with that change
Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem
#23Points for an excellent post-mortem.
Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem
#24> stored in our database which was not compromised
Personally I don't really agree with "was not compromised"
You say yourself that the guy had access to your secrets and AWS, I'd definitely consider that compromised even if the guy (to your knowledge) didn't read anything from the database. Assume breach if access was possible.
Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem
#25Given that all the stolen credentials were made public, I was hoping that someone would build a haveibeenpwned style site. We know we were compromised on at least a few tokens, but it would be nice to be able to search using a compromised token to find out what else leaked. We’ve rotated everything we could think of but not knowing if we’ve missed something sucks.
Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem
#26I have been thinking about this. How do I make my git setup on my laptop secure? Currently, I have my ssh key on the laptop, so if I want to push, I just use git push. And I have admin credentials for the org. How do I make it more secure?
You can set up your repo to disable pushing directly to branches like main and require MFA to use the org admin account, so something malicious would need to push to a benign branch and separately be merged into one that deploys come from.
But the attacker could just create a branch, merge request and then merge that?
Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem
#27> stored in our database which was not compromised Personally I don't really agree with "was not compromised" You say yourself that the guy had access to your secrets and AWS, I'd definitely consider that compromised even if the guy (to your knowledge) didn't read anything from the database. Assume breach if access was possible.
There are logs for accessing aws resources and if you don't see the access before you revoke it then the data is safe
Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem
#28I have been thinking about this. How do I make my git setup on my laptop secure? Currently, I have my ssh key on the laptop, so if I want to push, I just use git push. And I have admin credentials for the org. How do I make it more secure?
You can add a gpg key and subkeys to a yubikey and use gpg-agent instead of ssh-agent for ssh auth. When you commit or push, it asks you for a pin for the yubikey to unlock it.
There is the FIDO feature which means you don’t need to hackle with gpg at all. You can even use an ssh key as signing key to add another layer of security on the GitHub side by only allowing signed commits.
Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem
#29I have been thinking about this. How do I make my git setup on my laptop secure? Currently, I have my ssh key on the laptop, so if I want to push, I just use git push. And I have admin credentials for the org. How do I make it more secure?
You can add a gpg key and subkeys to a yubikey and use gpg-agent instead of ssh-agent for ssh auth. When you commit or push, it asks you for a pin for the yubikey to unlock it.
1 store my ssh key in 1Password and use the 1Password ssh agent. This agents asks for access to the key(s) with Touch ID. Either for each access or for each session etc. one can also whitelist programs but I think this all reduces the security.
Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem
#30I have been thinking about this. How do I make my git setup on my laptop secure? Currently, I have my ssh key on the laptop, so if I want to push, I just use git push. And I have admin credentials for the org. How do I make it more secure?
I’ve started to get more and more paranoid about this. It’s tough when you’re running untrusted code, but I think I’ve improved this by:
not storing SSH keys on the filesystem, and instead using an agent (like 1Password) to mediate access
Stop storing dev secrets/credentials on the filesystem, injecting them into processes with env vars or other mechanisms. Your password manager could have a way to do this.
Develop in a VM separate from your regular computer usage. On windows this is essential anyway through using WSL, but similar things exist for other OSs