Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Post Mortem: axios NPM supply chain compromise

github.com

Post reply on HN
Print view View original

141–150 of 165 posts

Re: Post Mortem: axios NPM supply chain compromise

#141

Post by dj_mc_merlin »

ajross wrote: post #137
dj_mc_merlin wrote: post #107

Earlier quoted context omitted.

Arch has pacman and that worked so well that it had to have AUR which is just glorified curl | bash. Linux distros managed it for decades when the vast majority of binaries you would run are made by nerds for nerds. If the original maintainer isn't willing to securely package it then you're often SOL.

AUR (also PPA which another comment cited) is emphatically not the same as "just run this script". If anything, and at worst, it's analogous to NPM: it's an unverified repository where the package is run at the whim of the author, and it leaves you subject to attacks against or by that author. You still, however, know that the author is who they say they are, and that other people (the distro maintainers) believe tha…

> You still, however, know that the author is who they say they are

This doesn't mean anything since "who they say they are" is an anonymous username with no real life correlation. Might as well be completely anonymous.

> that other people (the distro maintainers) believe that author to be the correct entity

No? Anyone can make an account and upload to AUR and it has exactly 0% to do with the distro maintainers. Packages can be removed if they're malicious, but websites can also be removed via browser-controlled blacklists (which I don't like btw but it's how it works nowadays).

> And any such compromise would, by definition, affect all users of the repo and presumably be detected by them and not by you in the overwhelmingly common case.

This is true of a popular website that advertises install instructions using curl | bash as well.

I've been using Linux for the past 2 decades and my general experience is that it is in no way more secure than Windows or Mac, just way less popular and with a more tech savvy userbase.

Re: Post Mortem: axios NPM supply chain compromise

#142

Post by ajross »

dj_mc_merlin wrote: post #141
ajross wrote: post #137

Earlier quoted context omitted.

AUR (also PPA which another comment cited) is emphatically not the same as "just run this script". If anything, and at worst, it's analogous to NPM: it's an unverified repository where the package is run at the whim of the author, and it leaves you subject to attacks against or by that author. You still, however, know that the author is who they say they are, and that other people (the distro maintainers) believe tha…

> You still, however, know that the author is who they say they are This doesn't mean anything since "who they say they are" is an anonymous username with no real life correlation. Might as well be completely anonymous. > that other people (the distro maintainers) believe that author to be the correct entity No? Anyone can make an account and upload to AUR and it has exactly 0% to do with the distro maintainers. Pack…

> This doesn't mean anything since "who they say they are" is an anonymous username with no real life correlation.

No, that's affirmatively incorrect. AUR and PPA both require authenticated accounts. The "real life correlation" may be anonymous to you, but it is trackable in a practical sense. And more importantly, it's stable: if someone pushes an attack to AUR (or NPM, whatever) the system shuts it down quickly.

And the proof is THAT IS EXACTLY WHAT HAPPENED HERE. NPM noticed the Axios compromise before you did, right? QED. NPM (and AUR et. al.) are providing herd protection that the script-paste hole does not.

Those scripts you insist on running simply don't provide that protection. The only reason you haven't been compromised is because you aren't important enough for anyone to care. The second you get maintainership over a valuable piece of software, you will be hacked. Because you've trained yourself to be vulnerable and (especially!) becuase you've demonstrated your softness to the internet by engaging in this silly argument.

Re: Post Mortem: axios NPM supply chain compromise

#143

Post by dj_mc_merlin »

ajross wrote: post #142
dj_mc_merlin wrote: post #141

Earlier quoted context omitted.

> You still, however, know that the author is who they say they are This doesn't mean anything since "who they say they are" is an anonymous username with no real life correlation. Might as well be completely anonymous. > that other people (the distro maintainers) believe that author to be the correct entity No? Anyone can make an account and upload to AUR and it has exactly 0% to do with the distro maintainers. Pack…

> This doesn't mean anything since "who they say they are" is an anonymous username with no real life correlation. No, that's affirmatively incorrect. AUR and PPA both require authenticated accounts. The "real life correlation" may be anonymous to you, but it is trackable in a practical sense. And more importantly, it's stable: if someone pushes an attack to AUR (or NPM, whatever) the system shuts it down quickly. An…

[flagged]

Re: Post Mortem: axios NPM supply chain compromise

#144

Post by simulator5g »

altmanaltman wrote: post #42
simulator5g wrote: post #4

Earlier quoted context omitted.

That's the reality of modern war. Many countries are likely planting malware on a wide scale. You can't even really prove where an attack originated from, so uninvolved countries would also be smart to take advantage of the current conflict. Like if you primarily wrote German, you would translate your malware to Chinese, Farsi, English, or Hebrew, and take other steps to make it appear to come from one of those warri…

You can write code in Chinese and Farsi?

Yes and there have been documented cases of translated malware. Sometimes its done a little sloppily and there is other evidence that points to the origin being in another country that doesn't speak the language its written in. But even then, you can't really prove they didn't just use a residential VPN or whatever.

Re: Post Mortem: axios NPM supply chain compromise

#145

Post by ajross »

dj_mc_merlin wrote: post #143
ajross wrote: post #142

Earlier quoted context omitted.

> This doesn't mean anything since "who they say they are" is an anonymous username with no real life correlation. No, that's affirmatively incorrect. AUR and PPA both require authenticated accounts. The "real life correlation" may be anonymous to you, but it is trackable in a practical sense. And more importantly, it's stable: if someone pushes an attack to AUR (or NPM, whatever) the system shuts it down quickly. An…

[flagged]

... you were the one who replied to me.

And, you were wrong, so I said so. Indeed this is a very frustrating site to post incorrect points. It's like ground zero for Cunningham's Law study cases.

Re: Post Mortem: axios NPM supply chain compromise

#146

Post by dj_mc_merlin »

ajross wrote: post #145
dj_mc_merlin wrote: post #143

Earlier quoted context omitted.

[flagged]

... you were the one who replied to me. And, you were wrong, so I said so. Indeed this is a very frustrating site to post incorrect points. It's like ground zero for Cunningham's Law study cases.

Are you happy? Ignoring everything else that's been said, I truly mean this: are you happy with the person you are?

Re: Post Mortem: axios NPM supply chain compromise

#147

Post by agumonkey »

falkensmaize wrote: post #95

The fetch api has been widely available in browsers for a decade now. And in node since 18. A competent developer could whip up a more axios-like library with fetch in a day easily. You can do all the cool things like interceptors with fetch too. Yet most developers I work with just use it reflexively. This seems like one of the biggest issues with the npm ecosystem - the complete lack of motivation to write even tri…

Maybe people are too comfy with axios base path url and interceptor api ? or maybe fetch handles that as well ? (through a shim ?)

Re: Post Mortem: axios NPM supply chain compromise

#148

Post by ajross »

dj_mc_merlin wrote: post #146
ajross wrote: post #145

Earlier quoted context omitted.

... you were the one who replied to me. And, you were wrong, so I said so. Indeed this is a very frustrating site to post incorrect points. It's like ground zero for Cunningham's Law study cases.

Are you happy? Ignoring everything else that's been said, I truly mean this: are you happy with the person you are?

Again, I'm really not understanding your offense here. You came to me to disagree with something I posted. And as it happened you were wrong. I told you so, and you dug in twice with more incorrect takes. That's just... discussion. And frankly pretty polite discussion even by the standards of this site (which is pretty polite!).

There's no etiquette that demands I not tell you you're wrong.

Re: Post Mortem: axios NPM supply chain compromise

#149

Post by falkensmaize »

port11 wrote: post #134
falkensmaize wrote: post #95

The fetch api has been widely available in browsers for a decade now. And in node since 18. A competent developer could whip up a more axios-like library with fetch in a day easily. You can do all the cool things like interceptors with fetch too. Yet most developers I work with just use it reflexively. This seems like one of the biggest issues with the npm ecosystem - the complete lack of motivation to write even tri…

Axios really does a lot of other great things. I would argue that Fetch could’ve easily been Axios-lite. Axios handles errors better, has interceptors, parses JSON for you, etc. The multiple supply chain attacks against NPM packages would, of course, be solved if we simply stop using third-party libraries.

I guess the point I’m making is that a lot of popular JavaScript libraries were created to address deficiencies in the core api that don’t exist anymore, but we keep using these libraries mostly because of entropy and familiarity.

Re: Post Mortem: axios NPM supply chain compromise

#150

Post by cindyllm »

dns_snek wrote: post #106
lrvick wrote: post #80

Earlier quoted context omitted.

Like I said. One must sign commits -universally- and -also- sign reviews/merges (multi-party) and then -also- do multi party signing on releases. The code in the release must match the code from git, or no publish. Until NPM can enforce those basic checks though, you have to roll your own CI to do it yourself, but large well funded widely used projects have an obligation to do the basics to protect their users, and t…

I agree, I just think it's pointless to discuss Axios' commit-signing practices or lack thereof when NPM doesn't support any of it. It seems like axios was already using Trusted Publishing [1] and it still didn't get caught. You said that you "also" blame NPM, but they're the only party who should get any blame until they get their shit together. [1] https://github.com/axios/axios/issues/10636#issuecomment-418...

[dead]
Post reply on HN