Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You too can run malware from NPM (I mean without consequences)

github.com

Post reply on HN
Print view View original

11–20 of 122 posts

Re: You too can run malware from NPM (I mean without consequences)

#11

Post by naugtur »

sesm wrote: post #5
mohsen1 wrote: post #3

npm should take responsibility and up their game here. It’s possible to analyze the code and mark it as suspicious and delay the publish for stuff like this. It should prevent publishing code like this even if I have a gun to my head

I think malware check should be opt-in for package authors, but provide some kind of 'verified' badge to the package. Edit: typo

npm is on life support by msft. But there's socket.dev that can tell you if a package is malicious within hours of it being published.

Re: You too can run malware from NPM (I mean without consequences)

#13

Post by clbrmbr »

naugtur wrote: post #8
clbrmbr wrote: post #6

How much money have the attackers stolen so far? Has someone done an analysis of the blockchains for the destination addresses?

click through to the article, it has a link to a view that lists the laughable profit

Huh. I read TFA in detail (and shared with my team), but I didn’t see any analysis. (?)

Re: You too can run malware from NPM (I mean without consequences)

#14

Post by naugtur »

clbrmbr wrote: post #10

Is it typical in the JS space to include dependencies without versioning? Also, curious: does freezing a version really provide much protection? Shouldn’t a commit hash be used? (Attacker can change a tag.)

packages published to npm are immutable. if you pin a version, you get the same exact version as long as MSFT servers are not compromised.

Installing from git is not recommended and has more issues than you might think https://dev.to/naugtur/a-phish-on-a-fork-no-chips-52cc

You are supposed to update packages, even if you use lockfiles (very common) or tools that pin your direct dependencies (renovate etc. not so common) And when you do update, will you read the package and all of its updated dependencies?

It's a hard problem with a bunch of tradeoffs.

Can be done, with enough attention and tools. Tools include LavaMoat :)

Re: You too can run malware from NPM (I mean without consequences)

#15

Post by nodesocket »

mohsen1 wrote: post #3

npm should take responsibility and up their game here. It’s possible to analyze the code and mark it as suspicious and delay the publish for stuff like this. It should prevent publishing code like this even if I have a gun to my head

Or at a minimum support yubikey for 2fa.

Re: You too can run malware from NPM (I mean without consequences)

#16

Post by naugtur »

naugtur wrote: post #4
cluckindan wrote: post #2

LavaMoat looks great on paper, but not supporting Webpack HMR is a dealbreaker.

You're using HMR in your app's production bundle? How?

If you mean during development - you can opt out of using lavamoat in development for your webpack bundle (I'm assuming you're not running your untested code on valuable data)

Re: You too can run malware from NPM (I mean without consequences)

#17

Post by nodesocket »

naugtur wrote: post #8
clbrmbr wrote: post #6

How much money have the attackers stolen so far? Has someone done an analysis of the blockchains for the destination addresses?

click through to the article, it has a link to a view that lists the laughable profit

I'm actually shocked they have not stolen more seeing the breach impact radius? Perhaps we can thank wallets and exchanges for blacklisting the addresses and showing huge warnings like the one shown in the article.

Re: You too can run malware from NPM (I mean without consequences)

#19

Post by vel0city »

clbrmbr wrote: post #10

Is it typical in the JS space to include dependencies without versioning? Also, curious: does freezing a version really provide much protection? Shouldn’t a commit hash be used? (Attacker can change a tag.)

The package-lock.json includes a hash of the package, not just a version number which should be immutable.

Re: You too can run malware from NPM (I mean without consequences)

#20

Post by shreddit »

naugtur wrote: post #11
sesm wrote: post #5

Earlier quoted context omitted.

I think malware check should be opt-in for package authors, but provide some kind of 'verified' badge to the package. Edit: typo

npm is on life support by msft. But there's socket.dev that can tell you if a package is malicious within hours of it being published.

“within hours” is at least one hour too late, and most likely multiple hours.
Post reply on HN