Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud Returns: Over 300 NPM Packages Infected

helixguard.ai

Post reply on HN
Print view View original

101–110 of 797 posts

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#101

Post by notpachet »

jacquesm wrote: post #80
anonymous908213 wrote: post #65

Earlier quoted context omitted.

Writing code yourself so as not to cultivate 1000 dependencies you can't possibly ensure the security of is not the same as writing assembly. That you even reach for that comparison is indicative of the deep rot in Javascript culture. Writing your own code is perceived as a completely unreasonable thing to be doing to 99% of JS-devs and that's why the web performs like trash and has breaches every other day, but it's…

> That you even reach for that comparison is indicative of the deep rot in Javascript culture. Sorry? No, I'm the guy that does write all of his code from scratch so you're entirely barking up the wrong tree here. I am just realistic in seeing that people are not going to write more code than they strictly speaking have to because that is the whole point of using Node in the first place . The Assembly language exampl…

I feel like there are merits to your argument but that you have a larger anti-JS bias that's leaking through. Not that there aren't problems with Node itself, but as many people have pointed out, there are plenty of organizations writing in Node that aren't pwn'd by these sorts of attacks because we don't blindly update deps.

Perfect is the enemy of good; dependency cooldown etc is enough to mitigate the majority of these risks.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#102

Post by reconnecting »

vintagedave wrote: post #2

Serious question: should someone develop new technologies using Node any more? A short time ago, I started a frontend in Astro for a SaaS startup I'm building with a friend. Astro is beautiful. But it's build on Node. And every time I update the versions of my dependencies I feel terrified I am bringing something into my server I don't know about. I just keep reading more and more stories about dangerous npm packages…

We chose to write our platform for product security analytics (1) with PHP, primarily because it still allows us to create a platform without bringing in over 100 dependencies just to render one page.

I know this is a controversial approach, but it still works well in our case.

"require": { "php": ">=8.0",

        "ext-mbstring": "*",

        "bcosca/fatfree-core": "3.9.1",

        "phpmailer/phpmailer": "6.9.3",

        "ruler/ruler": "0.4.0",

        "matomo/device-detector": "6.4.7" }
1. https://github.com/tirrenotechnologies/tirreno

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#104

Post by viraptor »

gred wrote: post #74
Gigachad wrote: post #13

Earlier quoted context omitted.

The problem isn't specific to node. NPM is just the most popular repo so the most value for attacks. The same thing could happen on RubyGems, Cargo, or any of the other package managers.

NPM has about 4 million packages, Maven Central has about 3 million packages. If this were true, wouldn't there have been at least one Maven attack by now, considering the number of NPM attacks that we've seen?

There were. They're just not as popular here. For example https://www.sonatype.com/blog/malware-removed-from-maven-cen...

Maven is also a bit more complex than npm and had an issue in the system itself https://arxiv.org/html/2407.18760v4

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#106

Post by skwee357 »

gred wrote: post #74
Gigachad wrote: post #13

Earlier quoted context omitted.

The problem isn't specific to node. NPM is just the most popular repo so the most value for attacks. The same thing could happen on RubyGems, Cargo, or any of the other package managers.

NPM has about 4 million packages, Maven Central has about 3 million packages. If this were true, wouldn't there have been at least one Maven attack by now, considering the number of NPM attacks that we've seen?

One speculation would be is that most Java apps in the wild use way older Java versions (say 17/11, while the latest will LTS is 21).

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#108

Post by notpachet »

jacquesm wrote: post #56
rvz wrote: post #16

Very concerning, so that was what the "impending disaster" was as I first noted. [0] Quite worrying that this happened again to the NPM ecosystem. Really looking forward to a deeper post-mortem on this. [0] https://news.ycombinator.com/item?id=46031864

It will keep happening until someone takes responsibility and starts maintaining the whole of the node eco system. This is probably a viable start-up idea: Node but audited.

Maybe we can convince Shopify to hijack NPM too while they're at it.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#109

Post by jacquesm »

notpachet wrote: post #101
jacquesm wrote: post #80

Earlier quoted context omitted.

> That you even reach for that comparison is indicative of the deep rot in Javascript culture. Sorry? No, I'm the guy that does write all of his code from scratch so you're entirely barking up the wrong tree here. I am just realistic in seeing that people are not going to write more code than they strictly speaking have to because that is the whole point of using Node in the first place . The Assembly language exampl…

I feel like there are merits to your argument but that you have a larger anti-JS bias that's leaking through. Not that there aren't problems with Node itself, but as many people have pointed out, there are plenty of organizations writing in Node that aren't pwn'd by these sorts of attacks because we don't blindly update deps. Perfect is the enemy of good; dependency cooldown etc is enough to mitigate the majority of…

> I feel like there are merits to your argument but that you have a larger anti-JS bias that's leaking through.

Familiarity breeds contempt.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#110

Post by vintagedave »

merelysounds wrote: post #34
vintagedave wrote: post #14

The list of packages looks like these are not just tiny solo-person dependencies-of-dependencies. I see AsyncAPI and Zapier there. Am I right that this seems quite a significant event? AsyncAPI is used as the example in the post. It says the Github repo was not affected, but NPM was. What I don't understand from the article is how this happened. Were the credentials for each project leaked? Given the wide range of pa…

There is an explanation in the article: > it modifies package.json based on the current environment's npm configuration, injects [malicious] setup_bun.js and bun_environment.js, repacks the component, and executes npm publish using stolen tokens, thereby achieving worm-like propagation. This is the second time an attack like this happens, others may be familiar with this context already and share fewer details and ex…

Thanks. I saw that sentence but somehow didn't parse it. Need a coffee :/
Post reply on HN