Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

github.com

Post reply on HN
Print view View original

131–140 of 296 posts

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#131

Post by chrisweekly »

evantbyrne wrote: post #114
elric wrote: post #74

This is critical infrastructure, and it gets compromised way too often. There are so many horror stories of NPM (and similar) packages getting filled with malware. You can't rely on people not falling for phishing 100% of the time. People who publish software packages tend to be at least somewhat technical people. Can package publishing platforms PLEASE start SIGNING emails. Publish GPG keys (or whatever, I don't car…

The email was sent from the 'npmjs dot help' domain. I'm not saying you're wrong, but also basic due diligence would have prevented this. If not by email, the maintainer may have been able to be compromised over text or some other medium. And today maintainers of larger projects can avoid these problems by not importing and auto-updating a bunch of tiny packages that look like they could have been lifted from stack o…

Re: "npmjs dot help", way too many companies use random domains -- effectively training their users to fall for phishing attacks.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#133

Post by chrisweekly »

tgv wrote: post #111
egorfine wrote: post #102

Earlier quoted context omitted.

> You can't rely on people not falling for phishing 100% of the time 1. I genuinely don't understand why. 2. If it is true that people are the failing factor, then nothing is going to help. Hardware keys? No problem, a human will use the hardware key to sign a malicious action.

> 1. I genuinely don't understand why. You never make a mistake? Never ever? It's a question of numbers. If the likelihood of making a mistake is 1 in 10000 emails, send out links to 10.000 package maintainers, and you've got a 63% chance of someone making that mistake.

Your point is completely valid. Tangent: in your example, what calculation led to "63%"?

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#134

Post by chrisweekly »

diggan wrote: post #105
jasode wrote: post #87

Earlier quoted context omitted.

> In hindsight, the fact that his browser did not auto-complete the login should have been a red flag. >A huge red flag. It won't be a red flag for people who often see auto-complete not working for legitimate websites. The usual cause is legitimate websites not working instead of actual phishing attempts. This unintended behavior of password managers changes the Bayesian probabilities in the mind such that username/…

> It won't be a red flag for people who often see auto-complete not working for legitimate websites. The usual cause is legitimate websites not working instead of actual phishing attempts. Yeah, that's true, I hit this all the time with 1Password+Firefox+Linux (fun combo). Just copying-pasting the username+password because it doesn't show up is the wrong approach. It gives you a chance to pause and reflect, since it…

> "It's really weird to hear people using password managers yet do the old copy-paste dance anyways."

Thankfully there are many reasons to use a password manager. Auto-fill is just one.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#135

Post by petcat »

jeswin wrote: post #132

Publishing could require clicking an email confirmation link, sent by npm.

It's all pointless theater because people want less friction to do what they want, not more. They'll just automate away the friction points like clicking an email confirmation link.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#136

Post by herpdyderp »

kaelwd wrote: post #115
herpdyderp wrote: post #58

Earlier quoted context omitted.

If I was forced to wait to download my own package updates I would simply stop using npm altogether and use something else.

It would be fine if you could still manually specify those versions eg. npm i duckdb@1.3.3 installs 1.3.3 but duckdb@latest or duckdb@^1.3 stays on 1.3.2 until 1.3.3 is ~a week old. https://github.com/pnpm/pnpm/issues/9921

Brilliantly simple, that would work for me!

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#137

Post by vitonsky »

Just for context. DuckDB team is consistently ignores any security practices.

The single one method how to install DuckDB on laptop is to run

`curl https://install.duckdb.org | sh`

I've requested to deliver CLI as standard package, they have ignored it. Here is the thread https://github.com/duckdb/duckdb/issues/17091

As you can see that it isn't single slip due to "human factor", but DuckDB management consistently puts users at risk.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#138

Post by egorfine »

elric wrote: post #110
egorfine wrote: post #102

Earlier quoted context omitted.

> You can't rely on people not falling for phishing 100% of the time 1. I genuinely don't understand why. 2. If it is true that people are the failing factor, then nothing is going to help. Hardware keys? No problem, a human will use the hardware key to sign a malicious action.

> 1. I genuinely don't understand why. It's a war of attrition. You can keep bombarding developers with new and clever ways of trying to obtain their credentials or get them to click on some link while signed in. It only has to succeed once. No one is 100% vigilant all the time. If you think you're the exception, you're probably deluding yourself. There's something broken in a system where one moment of inattention b…

Then see #2: there is no way to prevent humans from actually performing detrimental actions, hardware keys or not.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#139

Post by egorfine »

tgv wrote: post #111
egorfine wrote: post #102

Earlier quoted context omitted.

> You can't rely on people not falling for phishing 100% of the time 1. I genuinely don't understand why. 2. If it is true that people are the failing factor, then nothing is going to help. Hardware keys? No problem, a human will use the hardware key to sign a malicious action.

> 1. I genuinely don't understand why. You never make a mistake? Never ever? It's a question of numbers. If the likelihood of making a mistake is 1 in 10000 emails, send out links to 10.000 package maintainers, and you've got a 63% chance of someone making that mistake.

Then hardware 2FA won't help.
Post reply on HN