Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Axios compromised on NPM – Malicious versions drop remote access trojan

stepsecurity.io

Post reply on HN
Print view View original

331–340 of 894 posts

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#331

Post by Joeri »

vsgherzi wrote: post #63

Not to beat a dead horse but I see this again and again with dependencies. Each time I get more worried that the same will happen with rust. I understand the fat std library approach won’t work but I really still want a good solution where I can trust packages to be safe and high quality.

NPM should have a curation mechanism, via staff review or crowdsourcing, where versions of popular packages are promoted to a stable set, like linux distros do. I would only use curated versions if they had such a thing.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#332

Post by vips7L »

bob1029 wrote: post #312
christophilus wrote: post #295

Earlier quoted context omitted.

Honestly, you can get pretty far with just Bun and a very small number of dependencies. It’s what I love most about Bun. But, I do agree with you generally. .NET is about as good as I’ve ever seen for being batteries included. I just hate the enterprisey culture that always seems to pervade .NET shops.

I agree about the culture. If I take my eye off the dev team for too long, I'll come back and we'll be using entity framework and a 20 page document about configuring code cleanup rules in visual studio.

Entity framework is pretty good.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#334

Post by binarymax »

latexr wrote: post #225
ghurtado wrote: post #210

Earlier quoted context omitted.

If we're taking suggestions, I'd like to propose "parsec" (not to be confused with the unit of distance of the same name) That way Han Solo can make sense in the infamous quote. EDIT: even Gemini gets this wrong: > In Star Wars, a parsec is a unit of distance, not time, representing approximately 3.26 light-years

> That way Han Solo can make sense in the infamous quote. They explained it in the Solo movie. https://www.reddit.com/r/MovieDetails/comments/ah3ptm/solo_a...

Making a whole movie just to retcon the parsec misuse in Ep IV was a choice

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#335

Post by ptx »

wongarsu wrote: post #327
bob1029 wrote: post #241

"Batteries included" ecosystems are the only persistent solution to the package manager problem. If your first party tooling contains all the functionality you typically need, it's possible you can be productive with zero 3rd party dependencies. In practice you will tend to have a few, but you won't be vendoring out critical things like HTTP, TCP, JSON, string sanitation, cryptography. These are beacons for attackers…

> In practice you will tend to have a few, but you won't be vendoring out critical things like HTTP, TCP, JSON, string sanitation, cryptography Unless you are Python, where the standard library includes multiple HTTP libraries and everyone installs the requests package anyways. Few languages have good models for evolving their standard library, so you end up with lots of bad designs sticking around forever. Libraries…

I'm pretty sure it's really one HTTP library: urllib.request is built on top of http.client. But the very Java-inspired API for the former is awful.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#336

Post by filleokus »

red_admiral wrote: post #305

There's a package manager discussion, but the bit that stands out to me is that this started with a credential compromise. At some point when a project gets big enough like axios, maybe the community could chip in to buy the authors a couple of YubiHSM or similar. I wish that _important keys live in hardware_ becomes more standard given the stakes. Dealing with dependencies is another question; if it's stupid stuff l…

Totally agree.

Also, considering how prevalent TPM/Secure Enclaves are on modern devices, I would guess most package maintainers already have hardware capable of generating/using signing keys that never leave hardware.

I think it is mostly a devex/workflow question.

Considering the recent ci/cd-pipeline compromises, I think it would make sense to make a two phase commit process required for popular packages. Build and upload to the registry from a pipeline, but require a signature from a hardware resident key before making the package available.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#337

Post by ptx »

_pdp_ wrote: post #307

I am not saying this is the reason for this compromise but the sudden explosion of coding assistant like claude code, and tools like openclaw is teaching entire crop of developers (and users) that it is ok to have sensitive credentials .env files.

Where would you suggest putting the sensitive credentials?

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#338

Post by rolandog »

mewpmewp2 wrote: post #252
rolandog wrote: post #228

Earlier quoted context omitted.

And we need groups of locales for teams that are split across multiple locations; e.g.: new_date = add_workdays( workdays=1.5, start=datetime.now(), regions=["es", "mx", "nl", "us"], )

Hopefully "es" will have Siesta support too.

[dead]

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#339

Post by embedding-shape »

zdc1 wrote: post #275
bob1029 wrote: post #241

"Batteries included" ecosystems are the only persistent solution to the package manager problem. If your first party tooling contains all the functionality you typically need, it's possible you can be productive with zero 3rd party dependencies. In practice you will tend to have a few, but you won't be vendoring out critical things like HTTP, TCP, JSON, string sanitation, cryptography. These are beacons for attackers…

The other thing that keeps coming up is the github-code-is-fine-but-the-release-artifact-is-a-trojan issue. It really makes me question if "packages" should even exist in JavaScript, or if we could just be importing standard plain source code from a git repo. I understand why this doesn't work well with legacy projects, but it's something that the language could strive towards.

> I understand why this doesn't work well with legacy projects, but it's something that the language could strive towards.

Why wouldn't that work well with legacy projects? In fact, the projects I was a part of that I'd call legacy nowadays, was in fact built by copy-and-pasting .js libraries into a "vendor/" directory, and that's how we shipped it as well, this was in the days before Bower (which was the npm of frontend development back in the day), vendoring JS libs was standard practice, before package managers became used in frontend development too.

Not sure why it wouldn't work, JavaScript is a very moldable language, you can make most things work one way or another :)(

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#340

Post by staticassertion »

otterley wrote: post #65
XYen0n wrote: post #58

Earlier quoted context omitted.

If everyone avoids using packages released within the last 7 days, malicious code is more likely to remain dormant for 7 days.

What do you base that on? Threat researchers (and their automated agents) will still keep analyzing new releases as soon as they’re published.

> What do you base that on?

The entire history of malware lol

Post reply on HN