Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM flooded with malicious packages downloaded more than 86k times

arstechnica.com

Post reply on HN
Print view View original

131–140 of 308 posts

Re: NPM flooded with malicious packages downloaded more than 86k times

#131

Post by ares623 »

exe34 wrote: post #17
j1elo wrote: post #6

Earlier quoted context omitted.

Easy example that I know of: the Mediasoup project is a library written in C++ for streaming video over the internet. It is published as a Node package and offers a JS API. Upon installing, it would just download the appropriate C++ sources and compile them on the spot. The project maintainers wanted to write code, not manage precompiled builds, so that was the most logical way of installing it. Note that a while ago…

how hard would it be to say "upon first install, run do_sketchy_shit.sh to install requirements"?

You see, when you treat everything as a "product", this is what you end up with.

Re: NPM flooded with malicious packages downloaded more than 86k times

#132

Post by fragmede »

bigstrat2003 wrote: post #98
numbsafari wrote: post #27

Earlier quoted context omitted.

Don't do development on your local machine. Full stop. Just don't. Do development, all of it, inside VMs or containers, either local or remote. Use ephemeral credentials within said VMs, or use no credentials. For example, do all your git pulls on your laptop directly, or in a separate VM with a mounted volume that is then shared with the VM/containers where you are running dev tooling. This has the added benefit of…

That's not a realistic solution. Nobody is going to stop using their machine for development just to get some security gains, it's way too much of a pain to do that.

The way to sell it isn't vague security somethings, but in making it easier to reproduce the build environment "from scratch". If you build the Dockerfile as you go, then you don't waste hours at the end trying to figure out what you did to get it to build and run in the first place.

Re: NPM flooded with malicious packages downloaded more than 86k times

#133

Post by ashishb »

fragmede wrote: post #127
ashishb wrote: post #76

Earlier quoted context omitted.

> Also I can recommend pnpm, it has stopped executing lifecycle scripts by default so you can whitelist which ones to run. Imagine you are in a 50-person team that maintains 10 JavaScript projects, which one is easier? - Switch all projects to `pnpm`? That means switching CI, and deployment processes as well - Change the way *you* run `npm` on your machine and let your colleagues know to do the same I find the second…

Am I missing something? Don't you also need to change how CI and deployment processes call npm? If my CI server and then also my deployment scripts are calling npm the old insecure way, and running infected install scripts/whatever, haven't I just still fucked myself, just on my CI server and whatever deployment system(s) are involved? That seems bad.

Your machine has more projects, data, and credentials than your CI machine, as you normally don't log into Gmail on your CI. So, just protecting your machine is great.

Further, you are welcome to use this alias on your CI as well to enhance the protection.

Re: NPM flooded with malicious packages downloaded more than 86k times

#134

Post by Defletter »

nektro wrote: post #113
ab_testing wrote: post #108

Given the recent npm attacks, is it even safe to develop using npm. Whenever I start a react project, it downloads hundreds of additional packages which I have mo idea about what they do. As a developer who has learnt programming as a hobby, is it better to stick to some other safe ways to develop front end like thyme leaf or plain js or something else. When I build backend in flask or Django, I specifically type the…

this is one of the less talked about benefits of using bun

How does Bun avoid this? Or is it more that Bun provides things that you'd otherwise need a dependency for (eg: websockets)?

Re: NPM flooded with malicious packages downloaded more than 86k times

#135

Post by spicybright »

hinkley wrote: post #115
ashishb wrote: post #101

Earlier quoted context omitted.

No. Most valuable data on your system for a malware author is login cookies and saved auth tokens of various services.

Maybe keylogging for online services. But it is true that work and personal machines have different threat vectors.

Yes, but I'm willing to bet most workers don't follow strict digital life hygiene and cross contaminate all the time.

Re: NPM flooded with malicious packages downloaded more than 86k times

#136

Post by marcus_holmes »

devsda wrote: post #119
marcus_holmes wrote: post #106

Earlier quoted context omitted.

Somewhat controversial these days, but treat every single dependency as a potential security nightmare, source of bugs, problem that you will have to solve in the future. Use dependencies carefully and as a last resort. Vendoring dependencies (copying the package code into your project rather than using the package manager to manage it) can help - it won't stop a malicious package, but it will stop a package from tur…

Inspecting 10 layers of dependencies individually to install a popular tool or an lsp server is going to work once or twice. Eventually either complacency or fatigue sets in and the attacker wins. I think we need a different solution that fixes the dependency bloat or puts more safeguards around package publishing. The same goes for any other language with excessive third-party dependency requirements.

Agree.

It's going to take a lot of people getting pwned to change these attitudes though

Re: NPM flooded with malicious packages downloaded more than 86k times

#137

Post by IgorPartola »

exe34 wrote: post #17
j1elo wrote: post #6

Earlier quoted context omitted.

Easy example that I know of: the Mediasoup project is a library written in C++ for streaming video over the internet. It is published as a Node package and offers a JS API. Upon installing, it would just download the appropriate C++ sources and compile them on the spot. The project maintainers wanted to write code, not manage precompiled builds, so that was the most logical way of installing it. Note that a while ago…

how hard would it be to say "upon first install, run do_sketchy_shit.sh to install requirements"?

Hard. In npm land you install React and 900 other dependencies come with it. And how ok are you reviewing every single one of those scripts and manually running them? Not that it is good that this happens but realistically most people would just say “run all” and let it run instead of running each lifecycle script by hand.

Re: NPM flooded with malicious packages downloaded more than 86k times

#138

Post by fingerlocks »

kernc wrote: post #124
ashishb wrote: post #58

Here's my `npm` command these days. It reduces the attack surface drastically. alias npm='docker run --rm -it -v ${PWD}:${PWD} --net=host --workdir=${PWD} node:25-bookworm-slim npm' - No access to my env vars - No access to anything outside my current directory (usually a JS project). - No access to my .bashrc or other files. Ref: https://ashishb.net/programming/run-tools-inside-docker/

> alias npm=... I use sandbox-run: https://github.com/sandbox-utils/sandbox-run The above simple alias may work for node/npm, but it doesn't generalize to many other programs available on the local system, with resources that would need to be mounted into the container ...

Or use ‘chroot’. Or run it as a restricted owner with ‘chown’. Your grandparents solutions to these problems still work.

Re: NPM flooded with malicious packages downloaded more than 86k times

#139

Post by creativeSlumber »

> Many of the dependencies used names that are known to be “hallucinated” by AI chatbots. Developers frequently query these bots for the names of dependencies they need. LLM developers and researchers have yet to understand the precise cause of hallucinations or how to build models that don’t make mistakes. After discovering hallucinated dependency names, PhantomRaven uses them in the malicious packages downloaded from their site.

I found it very interesting that they used common AI hallucinated package names.

Re: NPM flooded with malicious packages downloaded more than 86k times

#140

Post by scuff3d »

socalgal2 wrote: post #111
ab_testing wrote: post #108

Given the recent npm attacks, is it even safe to develop using npm. Whenever I start a react project, it downloads hundreds of additional packages which I have mo idea about what they do. As a developer who has learnt programming as a hobby, is it better to stick to some other safe ways to develop front end like thyme leaf or plain js or something else. When I build backend in flask or Django, I specifically type the…

It's no different anywhere else. I just downloaded jj (rust), it installed 470+ packages When I downloaded wan2gp (python) it installed it install 211 packages.

One of the biggest things that pushes me away from Rust is the reliance on micro dependencies. It's a terrible model.
Post reply on HN