461–470 of 494 posts
That’s why I switched to Java.
You are absolutely right. The dangerous part of NPM packages is the post-install script . Therefore moving from JavaScript to Java removes the threat.
In every of these threads there's a bunch of snarky comments, either acting like this class of attack is exclusive to npm, or that nothing has been done about it. I don't think that's fair. There's plenty of comments mentioning delay lines, and the other good stuff pnpm (and others) have implemented in response to protect package consumers. That bit that's getting less conversation is the tools on the package maintai…
> In every of these threads there's a bunch of snarky comments, either acting like this class of attack is exclusive to npm, or that nothing has been done about it. I don't think that's fair. I mean it keeps happening lmao. You can track npm attacks these on a calendar. Someone made a npm parody of the classic "no way to avoid this" The Onion article. It's great there's work to stop it all but also... it keeps happen…
> … the classic "no way to avoid this" The Onion article
But isn't point of The Onion article that A) the US has >50x as many incidents as the rest of the developed world combined [1], and yet B) acts like there is "no way to avoid this". Does NPM have >50x as many incidents as the rest of established languages combined? Is NPM claiming there is "no way to avoid this" or are they putting in place things like automatic install delays?
While all the major js package managers already support install delays, none of the big local C#/dotnet/nuget apps do (Visual Studio/Rider/nuget/dotnet/VS Code). https://github.com/NuGet/Home/issues/14657
[1] https://edition.cnn.com/2018/05/21/us/school-shooting-us-ver...
Earlier quoted context omitted.
A lot of packages are pulled in to call minimal bits of the actual library. I obviously don't have any statistics on this but my instinct would say that for the average application only 5% of an average package is actually used. So not running package installation scripts is a huge, massive problem.
It doesn't matter how much of the package you use. Here, you can use literally 0% of Koa and get pwned by one of its transitive dependencies (koa > cookies > keygrip > tsscmp) by simply importing the parent package: mkdir demo && cd demo npm install --save koa@3.2.0 echo 'console.log("--- pwned by a transitive dependency ---")' >> node_modules/tsscmp/lib/index.js node -e "import 'koa'" --- pwned by a transitive depen…
Earlier quoted context omitted.
Nuget/.NET ecosystem just handles it so much better. Netvips assumes libvips is available and they provide packages for common platforms. No need to waste electricity rebuilding stuff, or install native build chains, build and test deps. Similar for Skia or Sqlite or whatever.
but how can you verify that the prebuilt binaries aren’t compromised?
Earlier quoted context omitted.
but how can you verify that the prebuilt binaries aren’t compromised?
Out of interest, do you verify that every single binary file on your machine isn't compromised? All the packages coming from your package manager?
My point was just that I don't think moving to pre-built binaries solves this issue.
Earlier quoted context omitted.
I don't agree that nobody is adopting them. Can you please elaborate? - Most companies I know have a 24 hours (at least) cooldown via their Artifactory / Nexus. They have ways to bypass it for urgent CVEs - pnpm just adopted 24 hours cooldown as default, based on community feedback.
what is the difference between these two things from the point of view of how much work you have to do? - checking every update of every dependency to see if is a relevant urgent security update - checking every update of every dependency to see if it turns out to be a supply chain exploit am i still checking every update of every dependency? there's no heuristic here. either you check them all, or you get randomly e…
Earlier quoted context omitted.
It doesn't matter how much of the package you use. Here, you can use literally 0% of Koa and get pwned by one of its transitive dependencies (koa > cookies > keygrip > tsscmp) by simply importing the parent package: mkdir demo && cd demo npm install --save koa@3.2.0 echo 'console.log("--- pwned by a transitive dependency ---")' >> node_modules/tsscmp/lib/index.js node -e "import 'koa'" --- pwned by a transitive depen…
My point was for proper package management tools that don't allow running scripts.
Hope it's ok I hijack this thread again about setting up cooldowns... (copy pasting my last comment when tanstack was compromised): I know people have opinions about cooldowns, but they would have saved you from axios, tanstack, (+ @redhat-cloud-services) and many other recent npm supply chain attacks. If you have Artifactory / Nexus, you probably already have cooldowns, but it's easy to set up if you don't. Why cool…
As an embedded dev who’s used to locking to toolchains and deps for years at a time, web dev is a culture shock in so many ways.
One thing I've never understood is why NPM allows packages to run code immediately after they are installed. What's the use case for that? A package should just be some code you can call on at runtime
Some packages need to build native dependencies. sharp for example needs to build libvips on the system [0] to work 0: https://github.com/lovell/sharp/blob/main/install/build.js
https://sharp.pixelplumbing.com/install/#prebuilt-binaries
It can usually also download a precompiled binary for the C++ shim that sits between node and libvips, but if your node / arch / etc. is not supported, it'll compile that (that's what the build.js file you linked does).
Earlier quoted context omitted.
Some packages need to build native dependencies. sharp for example needs to build libvips on the system [0] to work 0: https://github.com/lovell/sharp/blob/main/install/build.js
Nuget/.NET ecosystem just handles it so much better. Netvips assumes libvips is available and they provide packages for common platforms. No need to waste electricity rebuilding stuff, or install native build chains, build and test deps. Similar for Skia or Sqlite or whatever.
https://sharp.pixelplumbing.com/install/#prebuilt-binaries
it can sometimes need to compile the C++ shim that sits between node and libvips, but that's rare.