Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Npm install could be dangerous

github.com

Post reply on HN
Print view View original

31–40 of 100 posts

Re: Npm install could be dangerous

#31

Post by userbinator »

tootie wrote: post #6

I could just as easily embed something like that in any code on any open source project in any language as part of the installer or the main code base.

It doesn't even have to be intentional malice:

https://news.ycombinator.com/item?id=8896186

https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issue...

You can limit the damage by keeping backups, and running software you don't really trust under a limited account. The latter is understandably more difficult with certain applications, but it's once again one of those security-usability tradeoffs.

I basically avoid installing much in the way of new software as much as I can, as my existing setup does what I need, and anything new gets subjected to careful scrutiny first, but this is not a workable solution for everyone. Nevertheless, I can see how those with an attitude that makes them very eager to install and try new software could also make them more vulnerable to things like this.

Re: Npm install could be dangerous

#32

Post by raesene5 »

illumen wrote: post #20

npmjs still contains the package: https://www.npmjs.com/search?q=rimrafall https://www.npmjs.com/package/rimrafall '0 downloads in the last month' There is no 'report package' button. The support link goes to a 'we are hiring' contact form. Report bad packages as security issues? https://www.npmjs.com/security Package signing. Review process. Scanning tools for dangerous packages. As a user, don't trust anything and…

that's interesting. Any pointers to package stores that do a better job on security? I'm researching the area a bit at the moment and I've not seen a lot of good practice out there, so would be interesting to have some good examples to hold up.

Re: Npm install could be dangerous

#33

Post by [deleted] »

illumen wrote: post #20

npmjs still contains the package: https://www.npmjs.com/search?q=rimrafall https://www.npmjs.com/package/rimrafall '0 downloads in the last month' There is no 'report package' button. The support link goes to a 'we are hiring' contact form. Report bad packages as security issues? https://www.npmjs.com/security Package signing. Review process. Scanning tools for dangerous packages. As a user, don't trust anything and…

[deleted]

Re: Npm install could be dangerous

#34

Post by ffn »

Just another reason to install nodejs with a node versioning machine like nvm or n... or to chown your /usr dir so you don't have to run sudo every time you want to npm install. Since you need super user privileges to accidentally remove your system on most linux distros, it really helps if you don't form the habit of sudo npm installing everything.

Re: Npm install could be dangerous

#35

Post by attilagyorffy »

This is exactly why i think modern kernel level security layers, such as FreeBSD jails (or Docker/LXC) were born. Provided your app runs within a jail, it wouldn't matter much anymore:

> Once inside the jail, a process is not permitted to escape outside of this subtree

You could also develop within isolation, therefore your development env would be safer and even similar to a production environment. Needless to say, that has additional benefits.

Re: Npm install could be dangerous

#37

Post by sehr »

ffn wrote: post #34

Just another reason to install nodejs with a node versioning machine like nvm or n... or to chown your /usr dir so you don't have to run sudo every time you want to npm install. Since you need super user privileges to accidentally remove your system on most linux distros, it really helps if you don't form the habit of sudo npm installing everything.

Funnily enough https://github.com/tj/n/issues/86

Re: Npm install could be dangerous

#38

Post by thinkmoore »

jaxbot wrote: post #14
jbrooksuk wrote: post #11

Earlier quoted context omitted.

Or if it saw anything dangerous, it'd confirm that you want to run it. Edit: Fair points on all the comments below, pardon my ignorance :)

See Halting Problem: http://en.wikipedia.org/wiki/Halting_problem ELI5: It is proven to be impossible to tell exactly what a program is going to do without executing it.

While that may be true for an unrestricted language, it doesn't need to be true of the programs we design. There's no reason that an installer needs to be written in a completely unrestricted way. NPM could use a DSL which would make it possible to review what an installer is going to do.

This is an idea I (with some collaborators) have explored in a more general way for secure shell scripting: shill-lang.org.

Re: Npm install could be dangerous

#39

Post by thinkmoore »

raesene5 wrote: post #32
illumen wrote: post #20

npmjs still contains the package: https://www.npmjs.com/search?q=rimrafall https://www.npmjs.com/package/rimrafall '0 downloads in the last month' There is no 'report package' button. The support link goes to a 'we are hiring' contact form. Report bad packages as security issues? https://www.npmjs.com/security Package signing. Review process. Scanning tools for dangerous packages. As a user, don't trust anything and…

that's interesting. Any pointers to package stores that do a better job on security? I'm researching the area a bit at the moment and I've not seen a lot of good practice out there, so would be interesting to have some good examples to hold up.

We haven't developed far enough for a package store at this point, but this is one of the use cases we're hoping to explore as part of our capability-based shell scripting language: shill-lang.org.
Post reply on HN