70% of new NPM packages in last 6 months were spam • Hacker News Board

Re: 70% of new NPM packages in last 6 months were spam

#11

Post by 3np » Wed, Aug 07, 2024, 8:35 AM UTC

daotoad wrote: post #3

TLDR: 1. a cryptocurrency scheme for funding OSS development[1] is incentivizing spammers to try and monetize NPM spam 2. it's easy to spoof your dependencies with package.json[2] "dependencies": { "axios": "https://registry.npmjs.org/@putrifransiska/kwonthol36/-/kwonthol36-1.1.4.tgz" } [1]: https://tea.xyz/blog/the-tea-protocol-tokenomics [2]: https://www.npmjs.com/package/sournoise?activeTab=code

Re 2: How is that "spoofing"..?

You just demonstrated the uglier package-manager-independent overrides(npm)/resolutions(yarn) aliternative method. Because for whatever reason they couldn't play nice with each other.

npmjs.com seems to be interpreting the field incorrectly but 1) AIUI that does not affect actual npm usage, 2) If you rely on that website for supply-chain-security input I have bridge to sell... Basically all the manifest metadata is taken as-is and if the facts are important they should be separately verified out-of-band. Publishers could arbitrarily assign unassociated authors, repo URL, and so on.

https://docs.npmjs.com/cli/v9/configuring-npm/package-json#o...

https://classic.yarnpkg.com/lang/en/docs/selective-version-r...

Re: 70% of new NPM packages in last 6 months were spam

#12

Post by arp242 » Wed, Aug 07, 2024, 8:35 AM UTC

vorticalbox wrote: post #6

daotoad wrote: post #3

TLDR: 1. a cryptocurrency scheme for funding OSS development[1] is incentivizing spammers to try and monetize NPM spam 2. it's easy to spoof your dependencies with package.json[2] "dependencies": { "axios": "https://registry.npmjs.org/@putrifransiska/kwonthol36/-/kwonthol36-1.1.4.tgz" } [1]: https://tea.xyz/blog/the-tea-protocol-tokenomics [2]: https://www.npmjs.com/package/sournoise?activeTab=code

A "better" way is to modify the package-lock.json. You can still spoof the package but almost no one actually reviews it as npm will usually modify 1000s of lines. for example take mongoose "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-8.4.4.tgz", "integrity": "sha512-Nya808odIJoHP4JuJKbWA2eIaerXieu59kE8pQlvJpUBoSKWUyhLji0g1WMVaYXWmzPYXP2Jd6XdR4KJE8RELw==", so long as the integrity check passes for the…

Hugely surprising that package.json and package-lock.json don't have to match. The way I would expect it to work is something like:

  for d in dependencies_from_package_json()
    get_package(d)
    if hash_package(d) != package_lock_hash(d)
      error()
    end
  end

And not:

  use_package_lock_and_ignore_package_json_lol_fuck_you_haha_kthxbye()

I also discovered that npm doesn't actually verify what's in node_modules when using "npm install". I found this out a few ago after I had some corrupted files due to a flake internet connection. Hugely confusing. Also doesn't seem to be a straightforward way to check this (as near I could find in a few minutes).

But luckily "npm audit" will warn us about 30 "high severity" ReDos "high impact" "vulnerabilities" that can never realistically be triggered and are not really a "vulnerability" in the first place, let alone a "high impact" one.

Re: 70% of new NPM packages in last 6 months were spam

#13

Post by n_ary » Wed, Aug 07, 2024, 8:37 AM UTC

Why are these spam accounts not perma banned and removed?

For example, this[1] account mentioned in the article has 1781 packages of gibberish.

Also, the whole reporting process is onerous, there is a large form. Of course, gatekeeping on reporting is good, but there should be a possibility to report an entire profile of package publisher.

[1] https://www.npmjs.com/~eleanorecrockets

Re: 70% of new NPM packages in last 6 months were spam

#14

Post by throwaway290 » Wed, Aug 07, 2024, 8:55 AM UTC

vb-8448 wrote: post #5

I wonder what is the long term plan. Maybe the next step is to sell the control of all these packages to a rogue entity to be used for a supply chain attack?

Ban the root cause (funny token money). While incentive exists it will find a way.

Re: 70% of new NPM packages in last 6 months were spam

#15

Post by mikl » Wed, Aug 07, 2024, 9:12 AM UTC

A pox on Tea and the cryptobros that thought it was a good idea.

Re: 70% of new NPM packages in last 6 months were spam

#16

Post by marcus_holmes » Wed, Aug 07, 2024, 9:16 AM UTC

> Next, because the AI hype train is at full steam, we must point out the obvious. AI models that are trained on these packages will almost certainly skew the outputs in unintended directions. These packages are ultimately garbage, and the mantra of “garbage in, garbage out” holds true.

hmm, inspiring thoughts. An answer to "AI is going to replace software developers in the next 10 years" is to create 23487623856285628346 spam packages that contain pure garbage code. Humans will avoid, LLMs will hallucinate wildly.

Re: 70% of new NPM packages in last 6 months were spam

#17

Post by renegat0x0 » Wed, Aug 07, 2024, 9:22 AM UTC

I am really interested if that really matters.

Package managers often comes with rating system. npmjs has weekly downloads, pull requests, and other popularity scores.

I am layman in AI, but why would anyone think that this would affect anything, like AI? Why would anyone train on noname package, that noone uses?

Stats for spam packages can have higher-than-none stats, but that also makes them vulnerable for sweep removal of all potential spam packages, since they are connected, etc. etc.

Any credible company will not use a noname spam package, will verify their contents. That is at least what happened in all companies I have worked for.

Re: 70% of new NPM packages in last 6 months were spam

#18

Post by hsbauauvhabzb » Wed, Aug 07, 2024, 9:46 AM UTC

marcus_holmes wrote: post #16

> Next, because the AI hype train is at full steam, we must point out the obvious. AI models that are trained on these packages will almost certainly skew the outputs in unintended directions. These packages are ultimately garbage, and the mantra of “garbage in, garbage out” holds true. hmm, inspiring thoughts. An answer to "AI is going to replace software developers in the next 10 years" is to create 234876238562856…

Implying that npm wasn’t garbage before AI was mainstream?

Re: 70% of new NPM packages in last 6 months were spam

#19

Post by 3np » Wed, Aug 07, 2024, 9:48 AM UTC

vorticalbox wrote: post #6

daotoad wrote: post #3

TLDR: 1. a cryptocurrency scheme for funding OSS development[1] is incentivizing spammers to try and monetize NPM spam 2. it's easy to spoof your dependencies with package.json[2] "dependencies": { "axios": "https://registry.npmjs.org/@putrifransiska/kwonthol36/-/kwonthol36-1.1.4.tgz" } [1]: https://tea.xyz/blog/the-tea-protocol-tokenomics [2]: https://www.npmjs.com/package/sournoise?activeTab=code

A "better" way is to modify the package-lock.json. You can still spoof the package but almost no one actually reviews it as npm will usually modify 1000s of lines. for example take mongoose "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-8.4.4.tgz", "integrity": "sha512-Nya808odIJoHP4JuJKbWA2eIaerXieu59kE8pQlvJpUBoSKWUyhLji0g1WMVaYXWmzPYXP2Jd6XdR4KJE8RELw==", so long as the integrity check passes for the…

That (and anything else relying on the lockfile) won't take effect for users who install the package from the npm registry, unlike changes in package.json.

Re: 70% of new NPM packages in last 6 months were spam

#20

Post by 3np » Wed, Aug 07, 2024, 9:50 AM UTC

arp242 wrote: post #12

vorticalbox wrote: post #6

Earlier quoted context omitted.

A "better" way is to modify the package-lock.json. You can still spoof the package but almost no one actually reviews it as npm will usually modify 1000s of lines. for example take mongoose "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-8.4.4.tgz", "integrity": "sha512-Nya808odIJoHP4JuJKbWA2eIaerXieu59kE8pQlvJpUBoSKWUyhLji0g1WMVaYXWmzPYXP2Jd6XdR4KJE8RELw==", so long as the integrity check passes for the…

Hugely surprising that package.json and package-lock.json don't have to match. The way I would expect it to work is something like: for d in dependencies_from_package_json() get_package(d) if hash_package(d) != package_lock_hash(d) error() end end And not: use_package_lock_and_ignore_package_json_lol_fuck_you_haha_kthxbye() I also discovered that npm doesn't actually verify what's in node_modules when using "npm inst…

For situations when you care, go for `npm ci` instead of `npm install`. It will ensure lockfile consistency.

https://docs.npmjs.com/cli/v9/commands/npm-ci