Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Post Mortem: axios NPM supply chain compromise

github.com

Post reply on HN
Print view View original

111–120 of 165 posts

Re: Post Mortem: axios NPM supply chain compromise

#111

Post by darkwater »

nozzlegear wrote: post #97
ajross wrote: post #71

Earlier quoted context omitted.

> it seems the correct muscle memory response [is something other than] never download and execute anything Arrgh. You're looking at the closest thing to a root cause and you're just waving over it. The culture of "just paste this script" is the problem here . People trained not to do this (or, like me, old enough to be horrified about it and refuse on principle) aren't vulnerable. But you just... give up on that and…

> FWIW, there's also a root-er cause about where this culture came from. And that's 100% down to Apple Computer's congenital hatred of open source and refusal to provide or even bless a secure package management system for their OS. People do this because there's no feasible alternative on a mac, and people love macs more than they love security it seems. I don't understand. I used Linux for a long time before I swit…

Most of the copy-paste Linux command used to be 'sudo aptitude install -y blahblah'. It is worth noting though that Ubuntu's PPAs became at some point widespread enough to have pasting a new repo source as a standard practice as well (which would open the way to this kind of attack for sure)

Re: Post Mortem: axios NPM supply chain compromise

#112

Post by panstromek »

panstromek wrote: post #110
redoh wrote: post #92

[flagged]

Well, the hack didn't survive more than 2-3 hours if I'm not mistaken. I don't think that counts as "nobody acted on it."

Actually, from the OP, the timeline is:

> March 31, 00:21 UTC: axios@1.14.1 published with plain-crypto-js@4.2.1 injected

> March 31, around 01:00 UTC: axios@0.30.4 published with the same payload

> March 31, around 01:00 UTC: first external detections

> March 31, around 01:00 UTC: community members file issues reporting the compromise. The attacker deletes them using the compromised account.

So it was found out almost immediately.

Re: Post Mortem: axios NPM supply chain compromise

#113

Post by kro »

falkensmaize wrote: post #95

The fetch api has been widely available in browsers for a decade now. And in node since 18. A competent developer could whip up a more axios-like library with fetch in a day easily. You can do all the cool things like interceptors with fetch too. Yet most developers I work with just use it reflexively. This seems like one of the biggest issues with the npm ecosystem - the complete lack of motivation to write even tri…

I really don't get this either, I've always removed axios when it was preinstalled in a framework.

I use "xhr" via fetch extensively, it can do everything in day to day business for years with minimal boilerplate.

(The only exception known to me being upload progress/status indication)

Re: Post Mortem: axios NPM supply chain compromise

#114

Post by Hamuko »

hatmanstack wrote: post #10
Zopieux wrote: post #8

Not much we didn't know (you're basically SOL since an owner was compromised), however we now have a small peek into the actual meat of the social engineering, which is the only interesting news imho: https://github.com/axios/axios/issues/10636#issuecomment-418...

jasonsaayman and voxpelli had useful write ups from the "head on a swivel" perspective of what to watch out for. Jason mentioned "the meeting said something on my system was out of date." they were using Microsoft meeting and that's how they got RCE. Would love more color on that.

Makes me glad that I've only ever used my iPad whenever I've had to interview through Microsoft Teams.

Re: Post Mortem: axios NPM supply chain compromise

#115

Post by [deleted] »

lrvick wrote: post #81
charcircuit wrote: post #38

Earlier quoted context omitted.

And for 5 there should be help on the NPM end to make it so that the alarms can fire before the new update is actually revealed to the public. There could be a short staging time where it could be revoked before any harm has been done. During this staging time NPM should also scan the package through a malware scanner before allowing it to go public.

I agree that would be nice, but NPM absolutely will not do any basic supply chain integrity work. They are actively opposed to it citing concerns that it might turn off lower skill developers that would be too annoyed by tapping a yubikey to sign releases or code. I have talked to them enough times over the years to have completely given up here. Whats even more stupid is they actually started mandating 2FA for high…

[deleted]

Re: Post Mortem: axios NPM supply chain compromise

#116

Post by GandalfHN »

lrvick wrote: post #26
ipnon wrote: post #6

Earlier quoted context omitted.

NPM is designed to let you run untrusted code on your machine. It will never work. There is no game to step up. It's like asking an ostrich to start flying.

All maintainers need to do is code signing. This is a solved problem but the NPM team has been actively rejecting optional signing support for over a decade now. Even so maintainers could sign their commits anyway, but most are too lazy to spend a few minutes to prevent themselves from being impersonated.

[flagged]

Re: Post Mortem: axios NPM supply chain compromise

#117

Post by Chyzwar »

NPM should fix this mess.

Adding postinstall should require approval from NPM. NPM clients should not install freshly published packages. NPM packages should be scanned after publishing. High profile packages should verify upstream git hash signature. NPM install should run in sandbox and detect any attempt to install outside project directory.

But npm being part of multi trillion company cannot be bothered to fix any of these. Instead they push for tighter integration with GitHub with UX that suck.

Re: Post Mortem: axios NPM supply chain compromise

#118

Post by cromka »

Chyzwar wrote: post #117

NPM should fix this mess. Adding postinstall should require approval from NPM. NPM clients should not install freshly published packages. NPM packages should be scanned after publishing. High profile packages should verify upstream git hash signature. NPM install should run in sandbox and detect any attempt to install outside project directory. But npm being part of multi trillion company cannot be bothered to fix an…

> NPM clients should not install freshly published packages.

That would be a beautiful example of Cobra effect: what about updates that fix vulnerabilities? You're gonna force users to wait couple days or a week before they can get malware removed?

Re: Post Mortem: axios NPM supply chain compromise

#119

Post by Chyzwar »

cromka wrote: post #118
Chyzwar wrote: post #117

NPM should fix this mess. Adding postinstall should require approval from NPM. NPM clients should not install freshly published packages. NPM packages should be scanned after publishing. High profile packages should verify upstream git hash signature. NPM install should run in sandbox and detect any attempt to install outside project directory. But npm being part of multi trillion company cannot be bothered to fix an…

> NPM clients should not install freshly published packages. That would be a beautiful example of Cobra effect: what about updates that fix vulnerabilities? You're gonna force users to wait couple days or a week before they can get malware removed?

This could be controlled by npm. Client ask for available versions anyway. If package is security fix then it can be made available instantly. But this delay gives time for security scanners and time to notify maintainers that package was published.

Re: Post Mortem: axios NPM supply chain compromise

#120

Post by mememememememo »

Chyzwar wrote: post #117

NPM should fix this mess. Adding postinstall should require approval from NPM. NPM clients should not install freshly published packages. NPM packages should be scanned after publishing. High profile packages should verify upstream git hash signature. NPM install should run in sandbox and detect any attempt to install outside project directory. But npm being part of multi trillion company cannot be bothered to fix an…

Just ban postinstall.
Post reply on HN