Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Axios compromised on NPM – Malicious versions drop remote access trojan

stepsecurity.io

Post reply on HN
Print view View original

121–130 of 894 posts

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#121

Post by johntash »

himata4113 wrote: post #30

I recommend everyone to use bwrap if you're on linux and alias all package managers / anything that has post build logic with it. I have bwrap configured to override: npm, pip, cargo, mvn, gradle, everything you can think of and I only give it the access it needs, strip anything that is useless to it anyway, deny dbus, sockets, everything. SSH is forwarded via socket (ssh-add). This limits the blast radius to your CW…

Do you have a recommendation for something like bwrap but for macos? I've been trying to use bwrap more on my servers when I remember.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#122

Post by supernes »

jadar wrote: post #8

How much do you want to bet me that the credential was stolen during the previous LiteLLM incident? At what point are we going to have to stop using these package managers because it's not secure? I've got to admit, it's got me nervous to use Python or Node.js these days, but it's really a universal problem.

There are ways to limit the blast radius, like running them in ephemeral rootless containers with only the project files mounted.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#123

Post by himata4113 »

vips7L wrote: post #82
himata4113 wrote: post #30

I recommend everyone to use bwrap if you're on linux and alias all package managers / anything that has post build logic with it. I have bwrap configured to override: npm, pip, cargo, mvn, gradle, everything you can think of and I only give it the access it needs, strip anything that is useless to it anyway, deny dbus, sockets, everything. SSH is forwarded via socket (ssh-add). This limits the blast radius to your CW…

AFAIK maven doesn’t support post install logic like npm does. You have to explicitly optin with build plugins. It doesn’t let any arbitrary dependency run code on your machine.

some post processors have chains to execution (ex: lombok)

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#124

Post by micw »

himata4113 wrote: post #30

I recommend everyone to use bwrap if you're on linux and alias all package managers / anything that has post build logic with it. I have bwrap configured to override: npm, pip, cargo, mvn, gradle, everything you can think of and I only give it the access it needs, strip anything that is useless to it anyway, deny dbus, sockets, everything. SSH is forwarded via socket (ssh-add). This limits the blast radius to your CW…

> SSH is forwarded via socket

Maybe I misunderstood this point. But the ssh socket also gives access to your private keys, so I see no security gain in that point. Better to have a password protected key.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#125

Post by himata4113 »

johntash wrote: post #121
himata4113 wrote: post #30

I recommend everyone to use bwrap if you're on linux and alias all package managers / anything that has post build logic with it. I have bwrap configured to override: npm, pip, cargo, mvn, gradle, everything you can think of and I only give it the access it needs, strip anything that is useless to it anyway, deny dbus, sockets, everything. SSH is forwarded via socket (ssh-add). This limits the blast radius to your CW…

Do you have a recommendation for something like bwrap but for macos? I've been trying to use bwrap more on my servers when I remember.

unfortunately not, but there is work being done to support overlays properly I think?

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#126

Post by himata4113 »

micw wrote: post #124
himata4113 wrote: post #30

I recommend everyone to use bwrap if you're on linux and alias all package managers / anything that has post build logic with it. I have bwrap configured to override: npm, pip, cargo, mvn, gradle, everything you can think of and I only give it the access it needs, strip anything that is useless to it anyway, deny dbus, sockets, everything. SSH is forwarded via socket (ssh-add). This limits the blast radius to your CW…

> SSH is forwarded via socket Maybe I misunderstood this point. But the ssh socket also gives access to your private keys, so I see no security gain in that point. Better to have a password protected key.

It's so your private key is not stolen, but you're right passphrase protected keys win anyway. I use hardware keys so this isn't a problem for me to begin with.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#127

Post by umko21 »

postalcoder wrote: post #26

PSA: npm/bun/pnpm/uv now all support setting a minimum release age for packages. I also have `ignore-scripts=true` in my ~/.npmrc. Based on the analysis, that alone would have mitigated the vulnerability. bun and pnpm do not execute lifecycle scripts by default. Here's how to set global configs to set min release age to 7 days: ~/.config/uv/uv.toml exclude-newer = "7 days" ~/.npmrc min-release-age=7 # days ignore-scr…

The config for uv won't work. uv only supports a full timestamp for this config, and no rolling window day option afaik. Am I crazy or is this llm slop?

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#128

Post by hvb2 »

nananana9 wrote: post #114

Package managers are a failed experiment. We have libraries like SQLite, which is a single .c file that you drag into your project and it immediately does a ton of incredibly useful, non-trivial work for you, while barely increasing your executable's size. The issue is not dependencies themselves, it's transitive ones. Nobody installs left-pad or is-even-number directly, and "libraries" like these are the vast majori…

If you're developing for the web your attack surface is quite a bit bigger. Your proposed solution of copying a few files might work but how do you keep track of updates? You might be vulnerable to a published exploit fixed a few months ago. A package manager might tell you a new version is available. I don't know how that would work in your scenario.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#129

Post by friendzis »

wps wrote: post #115
friendzis wrote: post #104

Earlier quoted context omitted.

[flagged]

Hello. You missed the point I was making drastically. Of course for software that I build personally I can do all that, but not for all the random stuff in my system that I’m trusting maintainers to package for me, or otherwise good PKGBUILDS in the AUR. You physically cannot have the bandwidth to be on top of these supply chain issues all the time. Also, semantic versioning is not some golden goose that fixes this i…

> You physically cannot have the bandwidth to be on top of these supply chain issues all the time

> semantic versioning is not some golden goose that fixes this issue

Nothing is a golden goose, however semver is designed to limit the scope of incoming changes so you have a chance of staying on top.

> Vendoring dependencies is not a scalable solution for all the software people use.

There are literally three ways to deal with these supply chain issues:

1. Allocate the bandwidth yourself

2. Buy that bandwidth

3. Yolo

Post reply on HN