Half of all JavaScript npm packages could have been hacked via weak credentials
bleepingcomputer.com
Half of all JavaScript npm packages could have been hacked via weak credentials
1–10 of 38 posts
Re: Half of all JavaScript npm packages could have been hacked via weak credentials
#2worth mentioning, since this article npm has released two-factor authentication \o/
http://blog.npmjs.org/post/166039777883/protect-your-npm-acc...
make sure you turn it on.
Re: Half of all JavaScript npm packages could have been hacked via weak credentials
#3worth mentioning, since this article npm has released two-factor authentication \o/ http://blog.npmjs.org/post/166039777883/protect-your-npm-acc... make sure you turn it on.
I'm curious what the percentage of npm publishers that have this toggled on is, and I wish that was available data. First, in terms of all packages, and then of top 1000 packages. I'll wildly guess It's of no surprise to anyone that follows Node.js security at this stage that the third party dependency chain is really its biggest weak link. Jordan Wright did some good research a couple of months ago on Node dependency trees and malicious packages that's worth a read:
Re: Half of all JavaScript npm packages could have been hacked via weak credentials
#4worth mentioning, since this article npm has released two-factor authentication \o/ http://blog.npmjs.org/post/166039777883/protect-your-npm-acc... make sure you turn it on.
I'm curious what the percentage of npm publishers that have this toggled on is, and I wish that was available data. First, in terms of all packages, and then of top 1000 packages. I'll wildly guess It's of no surprise to anyone that follows Node.js security at this stage that the third party dependency chain is really its biggest weak link. Jordan Wright did some good research a couple of months ago on Node dependenc…
> I'm curious what the percentage of npm publishers that have this toggled on is, and I wish that was available data.
I know we're tracking this data and I bet a follow up post will be written at some point once some numbers are available. As you say, I expect 2fa will see wide adoption as soon as a stable version lands in the upstream Node.
Re: Half of all JavaScript npm packages could have been hacked via weak credentials
#5So, why is it they're not using certificates?
Re: Half of all JavaScript npm packages could have been hacked via weak credentials
#6worth mentioning, since this article npm has released two-factor authentication \o/ http://blog.npmjs.org/post/166039777883/protect-your-npm-acc... make sure you turn it on.
The problem with measures such as 2FA is that they are voluntarily implemented only by users who are most concerned about security, whereas users setting their password to "password" are on the opposite end of the spectrum.
What we really need is (1) 2FA and other enhanced security measures and (2) the ability to exclude all packages from a project, whether imported directly or indirectly, that do not abide with a minimum level of security.
Re: Half of all JavaScript npm packages could have been hacked via weak credentials
#7So, why is it they're not using certificates?
I can imagine this would lead to a rash of certificates committed to repositories on GitHub.
Re: Half of all JavaScript npm packages could have been hacked via weak credentials
#8The npm ecosystem is fundamentally insecure. Some highlights:
* I obtained accounts of 4 users from the top-20 list.
* One of those 4 users set their password back to the leaked one shortly after it was reset.
* 13 users [that I found the password for] had more than 50 million downloads/month.
* One of the users directly controlling more than 20 million downloads/month chose to improve their previously revoked leaked password by adding a ! to it at the end.
* While Skovoroda discovered credentials that granted him direct publish access to only 13% of npm packages, through dependencies, an attacker would have been able to spread his malicious code to about 52% of the entire npm ecosystem.
There is no bandaid to fix this structural issue.
Re: Half of all JavaScript npm packages could have been hacked via weak credentials
#9We're building everything on quicksand. I'm constantly amazed anything ever works.
Re: Half of all JavaScript npm packages could have been hacked via weak credentials
#10The npm ecosystem is fundamentally insecure. Some highlights: * I obtained accounts of 4 users from the top-20 list. * One of those 4 users set their password back to the leaked one shortly after it was reset. * 13 users [that I found the password for] had more than 50 million downloads/month. * One of the users directly controlling more than 20 million downloads/month chose to improve their previously revoked leaked…
I don't see how any of these reasons are why npm is "fundamentally insecure" any more than any other system involving humans.