Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Axios compromised on NPM – Malicious versions drop remote access trojan

stepsecurity.io

Post reply on HN
Print view View original

321–330 of 894 posts

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#321

Post by rjmunro »

zdragnar wrote: post #97
reactordev wrote: post #21

Earlier quoted context omitted.

You can do all of that in fetch really easily with the init object. fetch('https://api.example.com/data', { headers: { 'Authorization': 'Bearer ' + accessToken } })

There are pretty much two usage patterns that come up all the time: 1- automatically add bearer tokens to requests rather than manually specifying them every single time 2- automatically dispatch some event or function when a 401 response is returned to clear the stale user session and return them to a login page. There's no reason to repeat this logic in every single place you make an API call. Likewise, every respo…

> Likewise, every response I get is JSON.

fetch responses have a .json() method. It's literally the first example in MDN: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/U...

It's literally easier than not using JSON because I have to think about if I want `repsponse.text()` or `response.body()`.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#322

Post by wongarsu »

yohannesk wrote: post #206
friendzis wrote: post #189

Earlier quoted context omitted.

Workdays! Think about it, if you set the delay in regular days/seconds the updated dependency can get pulled in on a weekend with only someone maybe on-call. (Hope your timezones and tzdata correctly identifies Easter bank holiday as non-workdays)

And we also need localization. Each country can have their own holidays

Don't forget about regional holidays, which might follow arbitrary borders that don't match any of the official subdivisions of the country. Or may even depend on the chosen faith of the worker

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#323

Post by wongarsu »

cozzyd wrote: post #64
XYen0n wrote: post #58

Earlier quoted context omitted.

If everyone avoids using packages released within the last 7 days, malicious code is more likely to remain dormant for 7 days.

that's why people are telling others to use 7 days but using 8 days themselves :)

brb, switching everything to 9 days

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#324

Post by pamcake »

_lvbh wrote: post #60

There are so many scanners these days these things get caught pretty quick. I think we need either npm or someone else to have a registry that only lets through packages that pass these scanners. Can even do the virustotal thing of aggregating reports by multiple scanners. NPM publishes attestation for trusted build environments. Google has oss-rebuild. All it takes is an `npm config set` to switch registries anyways…

Sounds great until trivy images get compromised, like last week.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#325

Post by abluecloud »

zdragnar wrote: post #97
reactordev wrote: post #21

Earlier quoted context omitted.

You can do all of that in fetch really easily with the init object. fetch('https://api.example.com/data', { headers: { 'Authorization': 'Bearer ' + accessToken } })

There are pretty much two usage patterns that come up all the time: 1- automatically add bearer tokens to requests rather than manually specifying them every single time 2- automatically dispatch some event or function when a 401 response is returned to clear the stale user session and return them to a login page. There's no reason to repeat this logic in every single place you make an API call. Likewise, every respo…

that's such a weak argument. you can write about 20 lines of code to do exactly this without requiring a third party library.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#327

Post by wongarsu »

bob1029 wrote: post #241

"Batteries included" ecosystems are the only persistent solution to the package manager problem. If your first party tooling contains all the functionality you typically need, it's possible you can be productive with zero 3rd party dependencies. In practice you will tend to have a few, but you won't be vendoring out critical things like HTTP, TCP, JSON, string sanitation, cryptography. These are beacons for attackers…

> In practice you will tend to have a few, but you won't be vendoring out critical things like HTTP, TCP, JSON, string sanitation, cryptography

Unless you are Python, where the standard library includes multiple HTTP libraries and everyone installs the requests package anyways.

Few languages have good models for evolving their standard library, so you end up with lots of bad designs sticking around forever. Libraries are much easier to evolve, giving them the advantage in terms of developer UX and performance.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#328

Post by vips7L »

himata4113 wrote: post #123
vips7L wrote: post #82

Earlier quoted context omitted.

AFAIK maven doesn’t support post install logic like npm does. You have to explicitly optin with build plugins. It doesn’t let any arbitrary dependency run code on your machine.

some post processors have chains to execution (ex: lombok)

You explicitly opt in by using a compiler plugin. Merely having it as a dependency, like in npm, doesn’t mean it can run code at build time.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#329

Post by croemer »

TheTaytay wrote: post #309

I know there is a cooldown period for npm packages, but I’m beginning to want a cooldown for domains too. According to socket, the C2 server is sfrclak[.]com, which was registered in the last 24 hours.

NextDNS has a setting to block newly registered (<30d) domains.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#330

Post by doginasuit »

nananana9 wrote: post #114

Package managers are a failed experiment. We have libraries like SQLite, which is a single .c file that you drag into your project and it immediately does a ton of incredibly useful, non-trivial work for you, while barely increasing your executable's size. The issue is not dependencies themselves, it's transitive ones. Nobody installs left-pad or is-even-number directly, and "libraries" like these are the vast majori…

> We have libraries like SQLite, which is a single .c file that you drag into your project and it immediately does a ton of incredibly useful, non-trivial work for you, while barely increasing your executable's size.

I'm not sure why you believe this is more secure than a package manager. At least with a package manager there is an opportunity for vetting. It's also trivial that it did not increase your executable's size. If your executable depends on it, it increases its effective size.

Post reply on HN