Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

github.com

Post reply on HN
Print view View original

111–120 of 296 posts

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#111

Post by tgv »

egorfine wrote: post #102
elric wrote: post #74

This is critical infrastructure, and it gets compromised way too often. There are so many horror stories of NPM (and similar) packages getting filled with malware. You can't rely on people not falling for phishing 100% of the time. People who publish software packages tend to be at least somewhat technical people. Can package publishing platforms PLEASE start SIGNING emails. Publish GPG keys (or whatever, I don't car…

> You can't rely on people not falling for phishing 100% of the time 1. I genuinely don't understand why. 2. If it is true that people are the failing factor, then nothing is going to help. Hardware keys? No problem, a human will use the hardware key to sign a malicious action.

> 1. I genuinely don't understand why.

You never make a mistake? Never ever? It's a question of numbers. If the likelihood of making a mistake is 1 in 10000 emails, send out links to 10.000 package maintainers, and you've got a 63% chance of someone making that mistake.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#112

Post by mediumsmart »

eviks wrote: post #28
mediumsmart wrote: post #6

Comes with the territory considering that npm is defacto the number one enshittification dependency by now. But no worries - this will scale beautifully. downvotes appreciated but also happy to see one or two urls that would prove me wrong

In the spirit of a substantive discussion could you likewise share a couple that would prove you right?

First of all I have a theory that nothing can be proven but I can't prove it.

Second - an example for a javascript heavy npm utilizing tracking heavy / low content site has not much weight in proving me right - my view is an assumption - 2 examples of shitty tracking SEO AI garbage content blubber sites not using npm would substantially question my assumption... I am genuinely interested in the tech those sites would use instead.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#113

Post by mediumsmart »

hiccuphippo wrote: post #76
mediumsmart wrote: post #6

Comes with the territory considering that npm is defacto the number one enshittification dependency by now. But no worries - this will scale beautifully. downvotes appreciated but also happy to see one or two urls that would prove me wrong

I think the downvotes are because enshittification is a different thing, intentionally done by the developers themselves.

granted but the motivation is payment I think and that originates elsewhere.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#114

Post by evantbyrne »

elric wrote: post #74

This is critical infrastructure, and it gets compromised way too often. There are so many horror stories of NPM (and similar) packages getting filled with malware. You can't rely on people not falling for phishing 100% of the time. People who publish software packages tend to be at least somewhat technical people. Can package publishing platforms PLEASE start SIGNING emails. Publish GPG keys (or whatever, I don't car…

The email was sent from the 'npmjs dot help' domain. I'm not saying you're wrong, but also basic due diligence would have prevented this. If not by email, the maintainer may have been able to be compromised over text or some other medium. And today maintainers of larger projects can avoid these problems by not importing and auto-updating a bunch of tiny packages that look like they could have been lifted from stack overflow

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#115

Post by kaelwd »

herpdyderp wrote: post #58
ebfe1 wrote: post #19

Is it just me who think this could have been prevented if npm admins put in some sort of cool off period to only allow new versions or packages to be downloaded after being published by "x" amount of hours? This way the npm maintainer would get notifications on their email and react immediately? And if it is urgent fix, perhaps there can be a process to allow npm admin to approve and bypass publication cool off perio…

If I was forced to wait to download my own package updates I would simply stop using npm altogether and use something else.

It would be fine if you could still manually specify those versions eg. npm i duckdb@1.3.3 installs 1.3.3 but duckdb@latest or duckdb@^1.3 stays on 1.3.2 until 1.3.3 is ~a week old.

https://github.com/pnpm/pnpm/issues/9921

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#116

Post by pixl97 »

worble wrote: post #99
IshKebab wrote: post #44

Earlier quoted context omitted.

Probably the differentiating factor here is that the phishing message was very plausible. Normally they're full of spelling mistakes and unprofessional grammar. The domain was also plausible. I think where they got lucky is > In hindsight, the fact that his browser did not auto-complete the login should have been a red flag. A huge red flag. I wonder if browsers should actually detect if you're putting login details…

> Normally they're full of spelling mistakes and unprofessional grammar. Frankly I can't believe we've trained an entire generation of people that this is the key identifier for scam emails. Because native English speakers never make a mistake, and all scammers are fundamentally unable to use proper grammar, right?

I mean most of the time it's the companies themselves that teach people bad habits.

MyBank: "Don't click on emails from suspicious senders! Click here for more information" { somethingweirdmybank.com } -- Actual real email from my bank.

Like, wtf. Why are you using a totally different domain.

And the companies I've worked for do this kind of crap all the time. "Important company information" { learnaboutmycompany.com } -- Like, is this a random domain someone registered. Nope, actually belongs to the place I work for when we have a well known and trusted domain.

Oh, and it's the best when the legit sites have their own spelling mistakes.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#118

Post by eviks »

mediumsmart wrote: post #112
eviks wrote: post #28

Earlier quoted context omitted.

In the spirit of a substantive discussion could you likewise share a couple that would prove you right?

First of all I have a theory that nothing can be proven but I can't prove it. Second - an example for a javascript heavy npm utilizing tracking heavy / low content site has not much weight in proving me right - my view is an assumption - 2 examples of shitty tracking SEO AI garbage content blubber sites not using npm would substantially question my assumption... I am genuinely interested in the tech those sites would…

If you have such a theory, how does it make sense to ask others to do the impossible and prove anything???

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#119

Post by zokier »

elric wrote: post #96
zokier wrote: post #86

Earlier quoted context omitted.

Spf/dkim already authenticates the sender. But it doesn't help if the user doesn't check who the email is from. But in that case gpg would not help that much either.

SPF & DKIM are all but worthless in practice, because so many companies send emails from garbage domains, or add large scale marketing platforms (like mailchimp) to their SPF records. Like Citroen sends software update notifications for their cars from mmy-customerportal.com. That URL looks and sounds like a phisher's paradise. But somehow, it's legit. How can we expect any user to make the right decision when we pus…

The same problem applies to gpg. If companies can not manage to use consistent from addresses then do you really expect them to do any better with gpg key management?

"All legitimate npm emails are signed with GPG key X" and "All legitimate npm emails come from @npmjs.com" are equally strong statements.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#120

Post by mediumsmart »

eviks wrote: post #118
mediumsmart wrote: post #112

Earlier quoted context omitted.

First of all I have a theory that nothing can be proven but I can't prove it. Second - an example for a javascript heavy npm utilizing tracking heavy / low content site has not much weight in proving me right - my view is an assumption - 2 examples of shitty tracking SEO AI garbage content blubber sites not using npm would substantially question my assumption... I am genuinely interested in the tech those sites would…

If you have such a theory, how does it make sense to ask others to do the impossible and prove anything???

thats a fortune cookie - please stay on topic :)
Post reply on HN