'No way to prevent this,' says only package manager where this regularly happens • Hacker News Board

Re: 'No way to prevent this,' says only package manager where this regularly happens

#11

Post by p-e-w » Sat, May 16, 2026, 1:41 AM UTC

qrush wrote: post #2

[flagged]

You’re right. Major supply chain attacks affect far more people than school shootings do, and can potentially cost more lives through downstream effects.

It’s 2026. Software is critical infrastructure for global civilization now. Lives and livelihoods depend on it working reliably. The “it’s just bits on a computer” quip has been outdated for 20 years now.

Re: 'No way to prevent this,' says only package manager where this regularly happens

#12

Post by loloquwowndueo » Sat, May 16, 2026, 1:43 AM UTC

exabrial wrote: post #10

I really don't understand why the npm project cannot embrace PGP as an ambulatory 'good enough' solution.

The NIH mentality in the ecosystem would result in a JavaScript pgp library which itself would be an npm package and subject to supply chain attacks. lol.

Re: 'No way to prevent this,' says only package manager where this regularly happens

#13

Post by mrandish » Sat, May 16, 2026, 1:44 AM UTC

qrush wrote: post #2

[flagged]

But it's not comparing to school shootings, it's satirizing supposedly responsible parties who continue to deny responsibility despite repeated catastrophic failures which are their responsibility.

Re: 'No way to prevent this,' says only package manager where this regularly happens

#14

Post by cookiengineer » Sat, May 16, 2026, 1:47 AM UTC

aselimov3 wrote: post #8

What are the actual guarantees that go/Rust make that Python/npm don’t? It seems like it might just be that Python/npm are juicier targets? I’m starting to try and avoid all third party packages

I suppose that go's go:generate workflow can also be abused to land a worm like the ones spreading via npm, as you can build programs that just scrape the whole hard drive for git projects and patch the go.mod dependencies there, and you could also just write this in go as a toolchain script, for example.

NPM's achilles is the pre/postinstall step which can run arbitrary commands and shell scripts without the user having any way to intervene.

Dependencies must be run in isolated chroot sandboxes or better, inside containers. That would be the only way to mitigate this problem, as the filesystem of the operating system must be separated from the filesystem of the development workflow.

On top of that most host based firewalls are per-binary instead of per-cmdline. That leads to the warnings and rules relying on that e.g. "python" or "nodejs" getting network access allowlisted, instead of say "nodejs myworm.js". So firewalls in general are pretty useless against this type of malware.

Re: 'No way to prevent this,' says only package manager where this regularly happens

#15

Post by yieldcrv » Sat, May 16, 2026, 1:53 AM UTC

btown wrote: post #4

For those unfamiliar with the context: https://en.wikipedia.org/wiki/%27No_Way_to_Prevent_This,%27_...

the onion article is still up could link that

Re: 'No way to prevent this,' says only package manager where this regularly happens

#16

Post by godzillabrennus » Sat, May 16, 2026, 1:56 AM UTC

p-e-w wrote: post #6

With the recent high-profile attacks on PyPI packages, it’s no longer true that npm is the “only package manager where this regularly happens”. In fact, pip is much more dangerous than npm because it lacks a lockfile. uv fixes that, but adoption is proceeding at a snail’s pace.

UV adoption is happening, though. NPM is still the only name in town.

Re: 'No way to prevent this,' says only package manager where this regularly happens

#17

Post by Gigachad » Sat, May 16, 2026, 1:56 AM UTC

exabrial wrote: post #10

I really don't understand why the npm project cannot embrace PGP as an ambulatory 'good enough' solution.

Would that help? Most of these recent attacks, the attackers have gained access to the system that builds the packages. So it would have just signed the malicious build the same.

Re: 'No way to prevent this,' says only package manager where this regularly happens

#18

Post by panzi » Sat, May 16, 2026, 2:00 AM UTC

loloquwowndueo wrote: post #12

exabrial wrote: post #10

I really don't understand why the npm project cannot embrace PGP as an ambulatory 'good enough' solution.

The NIH mentality in the ecosystem would result in a JavaScript pgp library which itself would be an npm package and subject to supply chain attacks. lol.

A good part of it is already implemented in web crypto, which is supported by browsers and node. There is a chance that npm could implement something there without extra dependencies. Maybe I'm too optimistic?

Re: 'No way to prevent this,' says only package manager where this regularly happens

#19

Post by fragmede » Sat, May 16, 2026, 2:02 AM UTC

yieldcrv wrote: post #15

btown wrote: post #4

For those unfamiliar with the context: https://en.wikipedia.org/wiki/%27No_Way_to_Prevent_This,%27_...

the onion article is still up could link that

https://theonion.com/no-way-to-prevent-this-says-only-nation...

Re: 'No way to prevent this,' says only package manager where this regularly happens

#20

Post by jollyllama » Sat, May 16, 2026, 2:03 AM UTC

aselimov3 wrote: post #8

What are the actual guarantees that go/Rust make that Python/npm don’t? It seems like it might just be that Python/npm are juicier targets? I’m starting to try and avoid all third party packages

> It seems like it might just be that Python/npm are juicier targets?

Attackers go where the victims are. Frontend is a monoculture with the vast majority using NPM; backend, less so. This isn't an excuse for NPM, but another strike against it.

You could also argue that the attacks make a deeper point about frontend vs backend devs, but I won't go there.