Live data from Hacker News

Malicious npm packages detected across Red Hat Cloud Services

github.com

111–120 of 494 posts

Re: Malicious npm packages detected across Red Hat Cloud Services

#111
post #93

Earlier quoted context omitted.

Nearly every package manager I've ever used had post-install scripts. Most run as root, since that's what usually what the package manager runs as. It's not unreasonable: you're already installing software, which presents risks. If post-install scripts were not a thing, a payload could still run because you ran the software you installed. Or because the installer added it to auto-run. Or because the installer placed…

Nearly every package manager I've ever used had post-install scripts. You're collapsing two different threat models. The risk isn't that code runs, it's WHEN it runs. This worm spreads because npm install runs arbitrary scripts as you, automatically, just from resolving the tree. You don't have to build it, run it, or even import it. Opening the project in an IDE is enough. apt/dnf scripts run on packages a maintaine…

> You're collapsing two different threat models. The risk isn't that code runs, it's WHEN it runs.

> You don't have to build it, run it, or even import it

If you just installed something with npm, chances are you'll be running it shortly, either as a tool or a library, probably minutes or seconds later. I imagine the use case of installing an npm package you don't plan on using or transitively importing, constitute a small portion of npm installs.

Re: Malicious npm packages detected across Red Hat Cloud Services

#112
post #3

'No Way to Prevent This,' Says Only package manager Where This Regularly Happens Edit: some people don't understand that it's a defence to https://en.wikipedia.org/wiki/%27No_Way_to_Prevent_This,%27_...

There’s actually a blog post with that exact title.

https://kevinpatel.xyz/posts/no-way-to-prevent-this/

https://news.ycombinator.com/item?id=48155690

Re: Malicious npm packages detected across Red Hat Cloud Services

#113
post #71
post #3

'No Way to Prevent This,' Says Only package manager Where This Regularly Happens Edit: some people don't understand that it's a defence to https://en.wikipedia.org/wiki/%27No_Way_to_Prevent_This,%27_...

Please stop posting this on every single security incident thread with npm. It was funny once, it's just rehashing the same debate over and over.

Opponents of gun control surely feel the same way about the Onion’s story.

Re: Malicious npm packages detected across Red Hat Cloud Services

#114
post #82

Redhat's entire reason for existence is to prevent this.

not really, no.

So why else do we pay someone to package and certify/verify open source projects? This is absolutely 90++% of what should be RedHats core day job.

Re: Malicious npm packages detected across Red Hat Cloud Services

#118
I'm refactoring all my personal and research projects to utilize pure HTML/CSS without any dependency of JavaScript. This was always on the table but the cybersecurity risks from all programming languages and frameworks have increased due to AI.

I know of fundamental issues with JavaScript and see no reason why it's still standard on all web browsers.

Re: Malicious npm packages detected across Red Hat Cloud Services

#119

Earlier quoted context omitted.

Most of these are now building upon techniques that have already been exploited since past 1 years. This attack used 4 of those techniques. 1. Lifecycle Hook Execution 2. CI/CD Identity Plane Attacks 3. Maintainer Account Takeover and Malicious Publish 4. Self-Replicating npm Worms https://npm-supply-chain-attack-techniques.pagey.site/

Regardless of what these attacks exploit, see elsewhere a larping comment of mine: the solution exists, the implementation already mitigated numerous such and other exploits (it's nice to read "nix is not affected" on discourse or over matrix chat), it predates Docker by a decade, and is older than Ubuntu and Fedora (to give the perspective), yet people prefer to remain ignorant.

You can have a security solution but with large ecosystems like this it can’t be pushed to the ecosystem immediately and everyone will take longer to test and deploy.

Right now you could audit packages and make sure you don’t get the latest version

Re: Malicious npm packages detected across Red Hat Cloud Services

#120
post #9

Earlier quoted context omitted.

uv supports the same for any Python developers out there: https://docs.astral.sh/uv/concepts/resolution/#dependency-co...

And somehow poetry doesn’t in 2026.

I don't use poetry anymore but do check the updates before claiming such things

https://python-poetry.org/blog/announcing-poetry-2.4.0/

Post reply on HN