Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keyv and friends compromised in active Shai-Hulud supply chain attack

aikido.dev

Post reply on HN
Print view View original

91–100 of 145 posts

Re: Keyv and friends compromised in active Shai-Hulud supply chain attack

#91

Post by freakynit »

daniel_mcsoft wrote: post #41

The cheapest mitigation almost nobody deploys: a version cooldown. These worms get caught fast — this one was flagged same-day, and the article's own timeline shows detection racing ahead of spread. If your CI simply refuses to adopt any version published in the last N days (Renovate supports this natively via minimumReleaseAge), you convert "worm spreads through the ecosystem in hours" into "worm must survive N days…

First point.. plus, OTP/MFA authenticated publishing.

This OTP/MFA should come from package repositories, before the package is made publicly available. This is needed so that CD stage is not blocked.

OTP/MFA should be scoped to publishing user/org, not the package. How the OTP/MFA client is managed across the maintainers/org, lies in the scope of maintainers/org.

Re: Keyv and friends compromised in active Shai-Hulud supply chain attack

#92

Post by nubg »

varunsharma07 wrote: post #72

We (StepSecurity) published a full analysis of both payload stages: https://www.stepsecurity.io/blog/chaindrop-npm-worm Some additional detail from our analysis: 1. Provenance did not fail, it worked as designed and still shipped malware. The initial 11 packages were published through npm OIDC Trusted Publishing with valid SLSA attestations. The attacker compromised the maintainer's GitHub account and let the project…

ai slop comment. post the original prompt

Re: Keyv and friends compromised in active Shai-Hulud supply chain attack

#93

Post by acdha »

insanitybit wrote: post #69
acdha wrote: post #61

Earlier quoted context omitted.

It’s correct that NPM is not unique but it is the worst for cultural reasons: no other ecosystem started with such a limited language, which lead to the culture of publishing tons of small packages working around things which everything else had builtin. A Python project which has a hundred dependencies is considered quite large but the median React project had north of 30 thousand for years and years.

I think that's barely meaningful. Which of the compromised packages would have been part of any reasonable stdlib?

It’s not that there’s a single stdlib feature which would’ve stopped this but more that JavaScript developers have been conditioned that it’s normal to install tons of packages and update them quite frequently so there are a lot of individual maintainers who if compromised have a surprising impact.

You’re exposed as a function of the number of dependencies so the communities which most normalize many rapidly updating packages are going to be at greater risk. That’s not a simple trade off — that enterprise Java app which updates on a decadal cadence is still worse — but it means you need to accept the risk and use other mitigations.

Re: Keyv and friends compromised in active Shai-Hulud supply chain attack

#94

Post by bijowo1676 »

woodruffw wrote: post #79
bijowo1676 wrote: post #58

I have a suspicion that a lot of these supply chain compromises are done by the security researchers at security vendors, selling software to protect the software supply chain. Spreading fear to create demand for their products. Like in the good ole days of Windows 98 and antivirus era, a lot of advanced virus techniques in the wild came from the people who used to work for AV companies

That would be extremely surprising, given the number and severity of federal crimes involved. (I also dare say: many of these attackers demonstrate a better in-depth understanding of packaging ecosystems than supply chain security vendors do.)

the federal crimes part is irrelevant if its below the threshold of federal authorities actually cracking down on them and figuring out entire chain.

just because credit card theft and other types of scam are illegal

I remember how ddos attackers created "DDOS protection" companies to protect their victims against DDOS.

Re: Keyv and friends compromised in active Shai-Hulud supply chain attack

#95

Post by lurkerforawhile »

insanitybit wrote: post #43
thinkingemoji wrote: post #33

No way to prevent this says only package manager where this regularly happens

This is the most boring comment posted on every one of these. NPM is by no means the worst offender here and offers a ton of solutions to this, lots of package managers are behind it or equivalent. NPM gets targeted a lot because it's popular. That's it.

left-pad was over a decade ago. it's a problem with the registry itself, more than just the package manager.

Re: Keyv and friends compromised in active Shai-Hulud supply chain attack

#98

Post by altcognito »

insanitybit wrote: post #89
woodruffw wrote: post #82

Earlier quoted context omitted.

Yep. That remains the norm with Python source distributions as well. It’s a hard thing to overcome when it’s baked deeply into packaging assumptions.

Yeah, my point is just that other package managers aren't in a great spot. NPM even lets you separate out "publish" and "release" now where you can publish to the registry but you have to separately "ack" that to release. That's kinda a huge win if people use it. I just think the framing that npm is so bad is really flatly invalid.

> the framing that npm is so bad is really flatly invalid.

Is it really though if we're getting thousands of compromised packages regularly?

You can do all the right things and still be legit problematic.

Re: Keyv and friends compromised in active Shai-Hulud supply chain attack

#99

Post by pixl97 »

freakynit wrote: post #91
daniel_mcsoft wrote: post #41

The cheapest mitigation almost nobody deploys: a version cooldown. These worms get caught fast — this one was flagged same-day, and the article's own timeline shows detection racing ahead of spread. If your CI simply refuses to adopt any version published in the last N days (Renovate supports this natively via minimumReleaseAge), you convert "worm spreads through the ecosystem in hours" into "worm must survive N days…

First point.. plus, OTP/MFA authenticated publishing. This OTP/MFA should come from package repositories, before the package is made publicly available. This is needed so that CD stage is not blocked. OTP/MFA should be scoped to publishing user/org, not the package. How the OTP/MFA client is managed across the maintainers/org, lies in the scope of maintainers/org.

This still does nothing to prevent anyone from publishing a bad package, for example a compromised device/dev in the organization.

A cooldown of a day, and maybe not updating on weekends will save you from that.

It's time to stop moving at the speed of stupid.

Re: Keyv and friends compromised in active Shai-Hulud supply chain attack

#100

Post by woodruffw »

insanitybit wrote: post #89
woodruffw wrote: post #82

Earlier quoted context omitted.

Yep. That remains the norm with Python source distributions as well. It’s a hard thing to overcome when it’s baked deeply into packaging assumptions.

Yeah, my point is just that other package managers aren't in a great spot. NPM even lets you separate out "publish" and "release" now where you can publish to the registry but you have to separately "ack" that to release. That's kinda a huge win if people use it. I just think the framing that npm is so bad is really flatly invalid.

I don’t think npm itself is measurably bad in ways that are useful to index on. Like others, I think that JS as an ecosystem has a culture that encourages both dependency sprawl and living at the edge, both of which contribute to the end problem of OSS malware.

(Rust has a similar culture, to be clear. I don’t think it’s a death knell.)

Post reply on HN