Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM debug and chalk packages compromised

aikido.dev

Post reply on HN
Print view View original

141–150 of 796 posts

Re: NPM debug and chalk packages compromised

#141

Post by junon »

zachleat wrote: post #132
junon wrote: post #9

Hi, yep I got pwned. Sorry everyone, very embarrassing. More info: - https://github.com/chalk/chalk/issues/656 - https://github.com/debug-js/debug/issues/1005#issuecomment-3... Affected packages (at least the ones I know of): - ansi-styles@6.2.2 - debug@4.4.2 (appears to have been yanked as of 8 Sep 18:09 CEST) - chalk@5.6.1 - supports-color@10.2.1 - strip-ansi@7.1.1 - ansi-regex@6.2.1 - wrap-ansi@9.0.1 - color-conve…

Yo, someone at npm needs to unpublish simple-swizzle@0.2.3 IMMEDIATELY. It’s still actively compromised.

It's been almost two hours without a single email back from npm. I am sitting here struggling to figure out what to do to fix any of this. The packages that have Sindre as a co-publisher have been published over but even he isn't able to yank the malicious versions AFAIU.

If there's any ideas on what I should be doing, I'm all ears.

EDIT: I've heard back, they said they're aware and are on it, but no further details.

Re: NPM debug and chalk packages compromised

#142

Post by crooked-v »

goku12 wrote: post #56
nixosbestos wrote: post #25

Earlier quoted context omitted.

How is it terrifying? They clicked through a 2FA reset email, a process that I have never, and will never need to go through, and seemingly one that they didn't even initiate.

How many developers are there like him? If not him, they'll target someone else. And while you or I will never do such a thing under normal circumstances, that's a pretty simple mistake to make if you are stressed, sleep deprived or sick. We are supposed to have automatic safeguards against such simple mistakes. (We used to design stuff with the assumption that if a human mistake is possible, someone will eventually…

Also, companies have mass popularized the whole 'click a link in an email to login' thing, which really contributes to the mistake factor.

Re: NPM debug and chalk packages compromised

#143

Post by dboreham »

sugarpimpdorsey wrote: post #73
dboreham wrote: post #55

Earlier quoted context omitted.

I see (I think): they tricked you into entering a TOTP code into their site, which they then proxied to the real names, thereby authenticating as your account. Is that correct?

It only proves that TOTP is useless against phishing.

Yes. This attack would not have worked if FIDO2 (or the software emulation Passkey) had been used.

Re: NPM debug and chalk packages compromised

#144

Post by raddan »

jowea wrote: post #34
stathibus wrote: post #18

As an outsider to the npm ecosystem, reading this list of packages is astonishing. Why do js people import someone else's npm module for every little trivial thing?

This conversation been a thing since at least the leftpad event. It's just how the js ecosystem works it seems. The default library is too small perhaps?

Or the language is too braindead. `is-arrayish` should not even have to be a thing.

Re: NPM debug and chalk packages compromised

#146

Post by mewpmewp2 »

9dev wrote: post #124
krona wrote: post #59

Earlier quoted context omitted.

how about: grep -r "_0x112fa8"

Irritatingly, this doesn't turn up anything, despite having a theoretically-compromised project as per the package-lock.json… At least on my end

What do you mean irritatingly? Do you mean that you think 'grep -r "_0x112fa8"' is not enough or are you irritated that npm audit is flagging as if it was compromised?

Re: NPM debug and chalk packages compromised

#147

Post by palmfacehn »

imiric wrote: post #82
rudedogg wrote: post #41

Earlier quoted context omitted.

This is the answer IMO. The number of targets and noise would be a lot less if JS had a decent stdlib or if we had access to a better language in the browser. I have no hope of this ever happening and am abandoning the web as a platform for interactive applications in my own projects. I’d rather build native applications using SDL3 or anything else.

To be fair, this is not a problem with the web itself, but with the Node ecosystem. It's perfectly possible to build web apps without relying on npm at all, or by being very selective and conservative about the packages you choose as your direct and transitive dependencies. If not by reviewing every line of code, then certainly by vendoring them. Yes, this is more inconvenient and labor intensive, but the alternative…

I'm often surprised at the number of JS experts who struggle with the basics of the browser API. Instead of reasoning through the problem, many will reach for a framework or library.

Re: NPM debug and chalk packages compromised

#148

Post by quotemstr »

junon wrote: post #9

Hi, yep I got pwned. Sorry everyone, very embarrassing. More info: - https://github.com/chalk/chalk/issues/656 - https://github.com/debug-js/debug/issues/1005#issuecomment-3... Affected packages (at least the ones I know of): - ansi-styles@6.2.2 - debug@4.4.2 (appears to have been yanked as of 8 Sep 18:09 CEST) - chalk@5.6.1 - supports-color@10.2.1 - strip-ansi@7.1.1 - ansi-regex@6.2.1 - wrap-ansi@9.0.1 - color-conve…

Not your fault. Thanks for posting and being proactive about fixing the problem. It could happen to anyone.

And because it could happen to anyone that we should be doing a better job using AI models for defense. If ordinary people reading a link target URL can see it as suspicious, a model probably can too. We should be plumbing all our emails through privacy-preserving models to detect things like this. The old family of vulnerability scanners isn't working.

Re: NPM debug and chalk packages compromised

#149

Post by phkahler »

>> which silently intercepts crypto and web3 activity in the browser, manipulates wallet interactions, and rewrites payment destinations so that funds and approvals are redirected to attacker-controlled accounts without any obvious signs to the user.

If you're doing financial transactions using a big pile of NPM dependencies, you should IMHO be financially liable for this kind of thing when your users get scammed.

Re: NPM debug and chalk packages compromised

#150

Post by quotemstr »

goku12 wrote: post #99
sugarpimpdorsey wrote: post #73

Earlier quoted context omitted.

It only proves that TOTP is useless against phishing.

Every day brings me another reason to ask the question: "Why the hell did they throw away the idea of mutual TLS?". They then went onto invent mobile OTP, HOTP, TOTP, FIDO-U2F and finally came a full cycle by reinventing the same concept, but in a more complex incarnation - Passkeys.

Because the tech industry egregore is a middling LLM that gets it context window compacted every generation.
Post reply on HN