Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitLab discovers widespread NPM supply chain attack

about.gitlab.com

Post reply on HN
Print view View original

141–150 of 263 posts

Re: GitLab discovers widespread NPM supply chain attack

#141

Post by sigmoid10 »

qubex wrote: post #102

About a month ago I had a rather annoying task to perform, and I found an NPM package that handled it. I threw “brew install NPM” or whatever onto the terminal and watched a veritable deluge of dependencies download and install. Then I typed in ‘npm ’ and my hand hovered on the keyboard after the space as I suddenly thought long and hard about where I was on the risk/benefit curve and then I backspaced and typed “bre…

This is why you want containerisation or, even better, full virtualisation. Running programs built on node, python or any other ecosystem that makes installing tons of dependencies easy (and thus frustratingly common) on your main system where you keep any unrelated data is a surefire way to get compromised by the supply chain eventually. I don't even have the interpreters for python and js on my base system anymore - just so I don't accidentally run something in the host terminal that shouldn't run there.

Re: GitLab discovers widespread NPM supply chain attack

#142

Post by firesteelrain »

arkh wrote: post #71

Most of those attacks do the same kind of things. So I'm surprised to never see something akin to "our AI systems flagged a possible attack" in those posts. Or the fact Github from AI pusher fame Microsoft does not already use their AI to find this kind of attacks before they become a problem. Where is this miracle AI for cybersecurity when you need it?

SonaType Lifecycle has some magic to prevent these types of attacks. They claim it is AI based. Not sure how it all works as it is proprietary but it is one of the things we use at work. SonaType IQ server powers it

Re: GitLab discovers widespread NPM supply chain attack

#144

Post by 2OEH8eoCRo0 »

qubex wrote: post #102

About a month ago I had a rather annoying task to perform, and I found an NPM package that handled it. I threw “brew install NPM” or whatever onto the terminal and watched a veritable deluge of dependencies download and install. Then I typed in ‘npm ’ and my hand hovered on the keyboard after the space as I suddenly thought long and hard about where I was on the risk/benefit curve and then I backspaced and typed “bre…

It's funny because techies love to tell people that common sense is the best antivirus, don't click suspicious links, etc. only to download and execute a laundry list of unvetted dependencies with a keystroke.

Re: GitLab discovers widespread NPM supply chain attack

#145

Post by Hendrikto »

akshitgaur2005 wrote: post #131
mcny wrote: post #88

Earlier quoted context omitted.

> But protecting specific directories is just whack-a-mole. The real fix is to properly sandbox code - an access whitelist rather than blacklist I believe Wayland (don't quote me on this because I know exactly zero technical details) as opposed to x is a big step in this direction. Correct me if I am wrong but I believe this effort alone has been ongoing for a decade. A proper sandbox will take longer and risks being…

Maybe I am missing something but how and why would a display protocol have anything to do with file access model??

In Wayland you have these xdg-portals that broker access to the filesystem, microphone, webcam, etc. I am not knowledgeable about the security model though.

Re: GitLab discovers widespread NPM supply chain attack

#147

Post by gruez »

brabel wrote: post #130
gruez wrote: post #15

Earlier quoted context omitted.

So, EV code signing certificates? Windows has that, and it'll verify that right in the OS. Git for instance, shows as being signed by CN = Johannes Schindelin O = Johannes Schindelin S = Nordrhein-Westfalen C = DE Downside is the cost. Certificates cost hundreds of dollars per year. There's probably some room to reduce cost, but not by much. You also run into issues of paying some homeless person $50 to use their ide…

You don’t need certificates , just use PGP keys like Maven.

PGP keys don't tell you anything about a developers "real identity". Theoretically theres some "web of trust", but realistically everyone just blindly downloads whatever PGP key is listed on the repo's install instructions.

Re: GitLab discovers widespread NPM supply chain attack

#149

Post by philipwhiuk »

testdelacc1 wrote: post #76
dawnerd wrote: post #60

Everyone is blaming npm but GitHub should be put on blast too for allowing the repos to be created and not quickly flagged. GitHub has a massive malware problem as it is and it doesn’t get enough attention.

Wouldn’t have been that hard to write a rule that matches the repositories being created by this malware. It literally does the same thing to every victim.

Sure, but until the malware spreads quickly you don't know you need the rule.

Re: GitLab discovers widespread NPM supply chain attack

#150

Post by data-ottawa »

flir wrote: post #138
mcny wrote: post #86

Earlier quoted context omitted.

What is a proper solution for this? I don't imagine gpg can help if you encrypt it but decrypt it when you login to gnome, right? However, it would be too much of a hassle to have to authenticate each time you need a token. I imagine macOS people have access to the secure enclave using touch ID but then even that is not available on all devices. I feel like we are barking up the wrong tree here. The plain text token…

It might be possible to lash up a cross-plaform solution with KeePassXC. It's got an API that can be accessed from the command line (chezmoi uses it to add secrets to dotfiles). Yes, you'd be authenticating every time you need a token but that might not be too much of a burden if you spend most of your time on a machine with a fingerprint scanner. otoh I wouldn't do it, because I don't believe I could implement it se…

I’ve got this work 1password setup, the only issue is if you have background tasks.

I had a Borg backup script for example and 1password needed me to authenticate to run it.

Authenticating for ssh and git is great.

Post reply on HN