11–20 of 63 posts
This sounds like a prime new vector for malware, ironically.
And how a malware can use this if it's configured globally in a root:root owned config file?
But yeah, maybe through an exploit with a narrow reach. Once in, the malware can veto security updates and escalate to full control.
This seems to be primarily a problem with NPM, since it's the only package manager that I know of that allows for package authors to essentially run arbitrary post-install scripts silently package install. Shai Hulud/Mini Shai Hulud happened because of this obvious glaring hole in the system, they even had the script to download an official copy of Bun to spread itself in case the targeted machine has hardened their…
I’d even say perhaps we need a fine grained permission system like Apple provides, but for clis, not just something limited to maintainers of package managers.
Earlier quoted context omitted.
And how a malware can use this if it's configured globally in a root:root owned config file?
Not all package managers require root. But yeah, maybe through an exploit with a narrow reach. Once in, the malware can veto security updates and escalate to full control.
This seems to be primarily a problem with NPM, since it's the only package manager that I know of that allows for package authors to essentially run arbitrary post-install scripts silently package install. Shai Hulud/Mini Shai Hulud happened because of this obvious glaring hole in the system, they even had the script to download an official copy of Bun to spread itself in case the targeted machine has hardened their…
Modern package managers are not amenable to letting another script override its resolutions, and that is what needs fixing.
This seems to be primarily a problem with NPM, since it's the only package manager that I know of that allows for package authors to essentially run arbitrary post-install scripts silently package install. Shai Hulud/Mini Shai Hulud happened because of this obvious glaring hole in the system, they even had the script to download an official copy of Bun to spread itself in case the targeted machine has hardened their…
I agree with your premise. I’d even say perhaps we need a fine grained permission system like Apple provides, but for clis, not just something limited to maintainers of package managers.
well deno has the stuff... but deno's not popular (yet)
>Every package install is checked against the threat feed and it raises an exception if we find something malicious being installed. So your solution is to reinvent signature based antiviruses, like Norton Antivirus and McAffee? The problem with these 2000s approaches were that attackers could: 1- Fuzz their payloads so that they are never the same and they don't trigger detection. 2- Offload payload mechanisms so th…
Dependency Cooldowns can be implemented with global hooks, git-commit-signing checks can be implemented, LLM-scans can be implemented, someone can run the code in a jail and use the eBPF logs to publish a threat feed.
Modern language packaging is also _source available_, and we have a huge leg up over traditional virus scans - we have the source code almost always. You can do amazing static analysis.
Yes, it’s hard work. But package managers are doing it already. Yay and Paru both now support hooks. I’m offering to help for AUR to publish more metadata: https://lists.archlinux.org/archives/list/aur-dev@lists.arch...
This seems to be primarily a problem with NPM, since it's the only package manager that I know of that allows for package authors to essentially run arbitrary post-install scripts silently package install. Shai Hulud/Mini Shai Hulud happened because of this obvious glaring hole in the system, they even had the script to download an official copy of Bun to spread itself in case the targeted machine has hardened their…
Are you sure? I'm pretty sure .deb and .rpm packages both allow that
This seems to be primarily a problem with NPM, since it's the only package manager that I know of that allows for package authors to essentially run arbitrary post-install scripts silently package install. Shai Hulud/Mini Shai Hulud happened because of this obvious glaring hole in the system, they even had the script to download an official copy of Bun to spread itself in case the targeted machine has hardened their…
TFA is also a bit hazy on what hooks exactly?
System package managers (at least apt & portage) have a whole bunch of hooks. I guess this is talking about language package managers. TFA is also a bit hazy on what hooks exactly?
homebrew doesn't support hooks as a system package manager: https://github.com/ecosyste-ms/package-manager-hooks as an example.
I think the packaging ecosystem is varied enough that this should be left for the package managers to decide. Yarn allows dependency resolution and WebFetch overrides in its hooks for eg.