Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM package compromised by author: erases files on RU / BY computers on install

snyk.io

Post reply on HN
Print view View original

151–160 of 188 posts

Re: NPM package compromised by author: erases files on RU / BY computers on install

#151

Post by gtirloni »

gkbrk wrote: post #150
gtirloni wrote: post #104

Earlier quoted context omitted.

How are regular developers going to vet the literally 1000s of Node.js dependencies they rely on? And who's signing these updates? The package owner? Well, he's the one adding malicious code so he can sign whatever he wants. I'll say it again, Node.js needs a proper standard library like Go that takes care of common needs most people have. It's been improving but it was a historical mistake to let microdependencies r…

> How are regular developers going to vet the literally 1000s of Node.js dependencies they rely on? Perhaps they shouldn't be relying on thousands of NPM packages. It's not difficult to write JS code that doesn't `npm install` the entire package ecosystem.

If you use React, Vue and others, that decision has been made for you.

Re: NPM package compromised by author: erases files on RU / BY computers on install

#152

Post by YATA0 »

zozbot234 wrote: post #17
chizhik-pyzhik wrote: post #6

Regardless of your political position, this falls well within the definition of malware. It's irresponsible for the maintainer to allow this: https://github.com/RIAEvangelist/node-ipc/issues/233

Plenty of existing ransomwares delete user files on everything- but -RU machines. Perhaps the maintainer of this package subscribes to the old view that "turnabout is fair play".

No post body was provided.

Re: NPM package compromised by author: erases files on RU / BY computers on install

#153

Post by mariusor »

kbart wrote: post #129
kelnos wrote: post #108

Earlier quoted context omitted.

This is the sad thing about all of this. Many people are demonizing average Russian citizens for the actions of their government. When the US invaded Iraq in 2003, I was very much against it, but felt powerless to change the course of my government. (And the US government kept on doing what it felt like, no matter how unjust its actions.) While I was ashamed of my country's actions, I didn't think it would be fair fo…

Majority of average Russian citizens support their goverment actions against Ukraine. So in my book, they are also responsible.

> Majority of average Russian citizens support their goverment[sic] actions

That is a pretty bold claim to be made without any supporting evidence.

Re: NPM package compromised by author: erases files on RU / BY computers on install

#154

Post by [deleted] »

0x_rs wrote: post #26

Honestly a very harmful sort of "doing something about it". As if deleting someone's (presumably, normal people) files will make them more understanding of the difficulties in the ongoing conflict. Lying about it is also petty, as seen below. Malicious software is malicious regardless of any intentions and should be prosecuted as such. And if one really feels obliged to make their part as they wish, there's many exam…

[deleted]

Re: NPM package compromised by author: erases files on RU / BY computers on install

#155

Post by totony »

gtirloni wrote: post #104
totony wrote: post #71

Earlier quoted context omitted.

>This incident sets a dangerous precedent in breaking a chain of trust that today's software development heavily relies on Such precedents should be set, we shouldn't be relying on that chain of trust (as clearly demonstrated here). Updates should be vetted, signed, etc. Fetching stuff random people push to npm is a recipe for disaster.

How are regular developers going to vet the literally 1000s of Node.js dependencies they rely on? And who's signing these updates? The package owner? Well, he's the one adding malicious code so he can sign whatever he wants. I'll say it again, Node.js needs a proper standard library like Go that takes care of common needs most people have. It's been improving but it was a historical mistake to let microdependencies r…

IMO npm should have a "stable repo" and a "community repo" just like most distribution packagers have had for a long time.

Re: NPM package compromised by author: erases files on RU / BY computers on install

#156

Post by lithos »

dgellow wrote: post #144

People focus on the attack itself and reasons behind it. I feel that we are missing the bigger picture here: these type of supply chain attack in the open source world is a systematic problem. It’s a direct result of assumptions baked into services such as npm, pypi, rubygems, etc and assumptions people have regarding 3rd party dependencies. The blast radius is monstrously giant. We seem to be still very naive in the…

I agree here, it's insane the number of dependencies JS developers are willing to take on. A decent sized project will see tens of thousands of extra files added to it (even if a lot of it is noncode stuff like licensing). From an outsider it even looks like employability of someone goes up if they manage to add extra dependencies to a project, since they can point to their download count to a prospective employer.

It's insane how much legal liability a company is at for agreeing to so many unread licenses. And how much attack surface they're exposing themselves to with their sprawling dependency chains.

Re: NPM package compromised by author: erases files on RU / BY computers on install

#157

Post by tomjen3 »

slim wrote: post #52

This is crazy. Are you hating on every Russian now ? Nobody is chocked by how anger against the the russian state shifted to hate against russian people ?

I have seen enough war crime photage that I am willing to accept any amount of civilian damage against Russia that is going to have an effect on the war, short of nukes.

When your government uses hospital locations as a target list and drop bombs on shelters, I don’t care if your files gets deleted.

Re: NPM package compromised by author: erases files on RU / BY computers on install

#158

Post by beeboop »

ddaalluu2 wrote: post #148
QuadmasterXLII wrote: post #145

Earlier quoted context omitted.

At this point any damage to the Russian economy translates to Ukranian lives saved.

Really? How do you save lives but deleting the average Dmitry's personal computer files? Maybe they were even working on a popular open source product as many average Russians tend to do. You should re-evaluate your simplistic mindset

Causing tens or hundreds of thousands of wasted hours by (relatively) high-earning software developers in Russia (who average about 20k USD a year, or $11/hour) is only, generously, a few million dollars USD in "damages".

To clarify, not refuting your point. Just providing napkin math that I agree it doesn't do much.

Re: NPM package compromised by author: erases files on RU / BY computers on install

#159

Post by foverzar »

tomjen3 wrote: post #157
slim wrote: post #52

This is crazy. Are you hating on every Russian now ? Nobody is chocked by how anger against the the russian state shifted to hate against russian people ?

I have seen enough war crime photage that I am willing to accept any amount of civilian damage against Russia that is going to have an effect on the war, short of nukes. When your government uses hospital locations as a target list and drop bombs on shelters, I don’t care if your files gets deleted.

> I have seen enough war crime photage

You have participated in too many instances of two minutes hate and were gaslighted by propaganda.

I laugh hysterically (in a very sad way), as I scroll through /r/Ukraine and see yet another video headlined as "Another Russian war-crime in Ukraine", that I had already seen few years ago headlined as "Ukrainian war-crime in Donetsk".

There is no truth anymore, literally every man for himself.

Re: NPM package compromised by author: erases files on RU / BY computers on install

#160

Post by foverzar »

coolspot wrote: post #112

There is a possibilty that Russia reports that through Interpol Cybercrime or via diplomatic channel, then FBI will have to investigate and possibly lock up Brandon.

No, this mechanism is simply not working.

Western politicians and public media have been bashing and portraying Russia as "a haven for hackers" for some time now, but it's not like the US is any better from Russian perspective.

Russian law enforcement has huge stacks of unsolved cybercrime cases, that are essentially blocked by lack of cooperation from a foreign counterpart.

Post reply on HN