I see the model of "download any old shit off the internet and run it in production" is working out so well.
I don’t have much opinion of XRP but this is their official package, not a community package.
Offical XRP NPM package has been compromised and key stealing malware introduced
11–20 of 20 posts
Re: Offical XRP NPM package has been compromised and key stealing malware introduced
#12Fun fact: installing some common starter packages will explode to install over a 1000 npm packages, each of them can inject malware, even if the package isn’t used, and you’ll never know. Many packages will have over a 100 dependencies if you include the dev dependencies, so you can easily break a 1000.
Yes that is how dependencies work.
The crazy part here is that in most other ecosystems 100 dependencies is "crazy high" territory, and in JS it's apparently "we're just getting started". It's known for its approach to micropackaging everything in a separate library.
Re: Offical XRP NPM package has been compromised and key stealing malware introduced
#13Official and thorough support for SBOM* within major package repositories can not come sooner.
Re: Offical XRP NPM package has been compromised and key stealing malware introduced
#14Cryptocurrency packages used at scale should have wallet decoys setup for early detection of vulnerabilities like this.
Red teaming this, you’d delay exfiltration of the private key until the balance passes beyond a certain amount and you’re on mainnet.
Re: Offical XRP NPM package has been compromised and key stealing malware introduced
#15We run similar npm package monitors. The use of exotic tld domains such as 0x9c.xyz kind of gave it away because YARA Forge rules have native signatures to detect such domains.
It will be interesting t explore how the project got compromised and malicious packages published to the registry.
Re: Offical XRP NPM package has been compromised and key stealing malware introduced
#16Earlier quoted context omitted.
Yes that is how dependencies work.
The crazy part here is that in most other ecosystems 100 dependencies is "crazy high" territory, and in JS it's apparently "we're just getting started". It's known for its approach to micropackaging everything in a separate library.
The crazy thing is more that multiple versions of the same package could be installed as dependencies of dependencies...
They were thinking to be the cool kids supporting multiple versions and that the old way to do packaging, like debian and co that expects everyone to use the same version, was the old legacy fart way to do things.
Just, developers before were engineers first and so designed things well especially to avoid this situation of dependency hell and supply chain injection. But the web dev crowd decided to do "better" and now to have old problems as new problems...
Re: Offical XRP NPM package has been compromised and key stealing malware introduced
#17Earlier quoted context omitted.
The crazy part here is that in most other ecosystems 100 dependencies is "crazy high" territory, and in JS it's apparently "we're just getting started". It's known for its approach to micropackaging everything in a separate library.
The crazy thing is more that multiple versions of the same package could be installed as dependencies of dependencies... They were thinking to be the cool kids supporting multiple versions and that the old way to do packaging, like debian and co that expects everyone to use the same version, was the old legacy fart way to do things. Just, developers before were engineers first and so designed things well especially t…
npm design allows multiple versions of the same package if required, but deduplicates otherwise. It’s a smart design that more package managers should and will follow.
Smart developers spend their time working on original code rather than rewriting the wheel.
Re: Offical XRP NPM package has been compromised and key stealing malware introduced
#18Fun fact: installing some common starter packages will explode to install over a 1000 npm packages, each of them can inject malware, even if the package isn’t used, and you’ll never know. Many packages will have over a 100 dependencies if you include the dev dependencies, so you can easily break a 1000.
does the postinstall script step has anything to do with this?
i noticed bun doesn't run them by default unless you whitelist them
Re: Offical XRP NPM package has been compromised and key stealing malware introduced
#19Earlier quoted context omitted.
Yes that is how dependencies work.
The crazy part here is that in most other ecosystems 100 dependencies is "crazy high" territory, and in JS it's apparently "we're just getting started". It's known for its approach to micropackaging everything in a separate library.
Yes. It’s an engineering failure to have multiple copies of the same logic. That isn’t specific to JavaScript.
Re: Offical XRP NPM package has been compromised and key stealing malware introduced
#20We run similar npm package monitors. The use of exotic tld domains such as 0x9c.xyz kind of gave it away because YARA Forge rules have native signatures to detect such domains. It will be interesting t explore how the project got compromised and malicious packages published to the registry.
.xyz isn’t exotic for blockchains.