Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

github.com

Post reply on HN
Print view View original

151–160 of 296 posts

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#151

Post by jonhohle »

jve wrote: post #70
IshKebab wrote: post #44

Earlier quoted context omitted.

Probably the differentiating factor here is that the phishing message was very plausible. Normally they're full of spelling mistakes and unprofessional grammar. The domain was also plausible. I think where they got lucky is > In hindsight, the fact that his browser did not auto-complete the login should have been a red flag. A huge red flag. I wonder if browsers should actually detect if you're putting login details…

> Normally they're full of spelling mistakes and unprofessional grammar. The domain was also plausible. I don't get these arguments. Yeah, of course I was always surprised phishing emails give itself away with mistakes as maybe non-native speakers create it without any spellcheck or whatever and it was straight forward to improve that... but whatever the text, if I open a link from email the first thing I look at is…

Nearly every email link now goes through an analytics domain that looks like a jumble of random characters. In the best case they end up at the expected site, but a significant number go to B2B service provider of the week’s domain.

There are more than a few instances when I’ve created an account for a service I know I’ve never interacted with before, but my password manager offered to log me in because another business I’ve used in the past used the same service (medical providers, schools, etc.).

Even as a technically competent person, I received a legitimate email from Google regarding old shadow accounts they were reconciling from YouTube and I spent several hours convinced it was a phishing scheme.it put me on edge for nearly a week that there was no way I could be sure critical accounts were safe, and worse yet, someone like my parents or in-laws could be safe.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#152

Post by vitonsky »

throwaway127482 wrote: post #143
vitonsky wrote: post #137

Just for context. DuckDB team is consistently ignores any security practices. The single one method how to install DuckDB on laptop is to run `curl https://install.duckdb.org | sh` I've requested to deliver CLI as standard package, they have ignored it. Here is the thread https://github.com/duckdb/duckdb/issues/17091 As you can see that it isn't single slip due to "human factor", but DuckDB management consistently pu…

Genuine question: why is `curl https://trusted-site.com | sh` a security risk? Fundamentally, doesn't the security depend entirely on whether https is working properly? Even the standard package repos are relying on https right? Like, I don't see how it's different than going to their website, copying their recommended command to install via a standard repo, then pasting that command into your shell. Either way, you…

Current incident confirms that we can't trust to authors of DuckDB, because they can't evade a trivial phishing attack.

Tomorrow they will do it again, and attackers will replace binary files that users download with this random script. Or this script will steal crypto/etc.

To make attack vector difficult for hackers, it's preferable to download any software as packages. On linux it looks like `apt install python3`.

The benefits is

1. Repositories are immutable, so attacker can't replace binary for specific version, even if they will hack all infrastructure of DuckDB. Remote script may be replaced anytime to run any code

2. Some repositories have strict review process, so there are external reviewers who will require to pass security processes to upload new version

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#153

Post by hu3 »

johnisgood wrote: post #140
theanonymousone wrote: post #125

How do these things mostly happen for npm? Why not (much) PyPI or Maven? Or do they?

Or Cargo. I compiled Zed with release mode, pulled in 2000 dependencies. It does not fill me with confidence.

On a related note, the maintainer of the compromised npm packages, debug and chalk, who got pawned, is creating an operational system in rust.

https://github.com/oro-os

https://news.ycombinator.com/user?id=junon

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#154

Post by kaelwd »

ApolloFortyNine wrote: post #147
kaelwd wrote: post #115

Earlier quoted context omitted.

It would be fine if you could still manually specify those versions eg. npm i duckdb@1.3.3 installs 1.3.3 but duckdb@latest or duckdb@^1.3 stays on 1.3.2 until 1.3.3 is ~a week old. https://github.com/pnpm/pnpm/issues/9921

Except they'd have to have an override for when there's a zero day, at which point we're back where we started.

Versions with a serious vulnerability should be deprecated by the maintainer which then warns you to use a newer version when installing. Yes if a npm account is compromised the attacker could deprecate everything except their malicious version but it would still significantly reduce the attack surface by requiring manual intervention vs the current npm install foo@latest -> you're fucked.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#155

Post by kaelwd »

ebfe1 wrote: post #19

Is it just me who think this could have been prevented if npm admins put in some sort of cool off period to only allow new versions or packages to be downloaded after being published by "x" amount of hours? This way the npm maintainer would get notifications on their email and react immediately? And if it is urgent fix, perhaps there can be a process to allow npm admin to approve and bypass publication cool off perio…

NPM could also flag releases that don't have a corresponding github tag (for packages that are hosted on github), most of these attacks are publishing directly to NPM without any git changes.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#156

Post by udev4096 »

> This website contained a pixel-perfect copy of the npmjs.com website

This should not be considered high effort or a sophisticated attack. The attacker probably used a mitm proxy which can easily replicate every part of your site, with very little initial configuration. Evilginx is the most popular one I could think of

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#157

Post by udev4096 »

eviks wrote: post #38

> This website contained a *pixel-perfect copy* of the npmjs.com website. Not sure how this emphasis is of any importance, you brain doesn't have a pixel perfect image of the website, so you wouldn't know whether it's a perfect replica or not. Let the silicon dummies in the password manager do the matching, don't strain your brain with such games outside of entertainment

A mitm proxy can replicate the whole site, it's almost impossible to distinguish from the real one other than the checking the domain

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#158

Post by sroussey »

SoftTalker wrote: post #94
elric wrote: post #74

This is critical infrastructure, and it gets compromised way too often. There are so many horror stories of NPM (and similar) packages getting filled with malware. You can't rely on people not falling for phishing 100% of the time. People who publish software packages tend to be at least somewhat technical people. Can package publishing platforms PLEASE start SIGNING emails. Publish GPG keys (or whatever, I don't car…

I think you just have to distrust email (or any other "pushed" messages), period. Just don't ever click on a link in an email or a message. Go to the site from your own previously bookmarked shortcut, or type in the URL. I got a fraud alert email from my credit card the other day. It included links to view and confirm/deny the suspicious charge. It all looked OK, the email included my name and the last digits of my a…

I get Coinbase SMS all the time with a code not to share. But also… “call this phone number if you did not request the code”.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#159

Post by vel0city »

zokier wrote: post #86
elric wrote: post #74

This is critical infrastructure, and it gets compromised way too often. There are so many horror stories of NPM (and similar) packages getting filled with malware. You can't rely on people not falling for phishing 100% of the time. People who publish software packages tend to be at least somewhat technical people. Can package publishing platforms PLEASE start SIGNING emails. Publish GPG keys (or whatever, I don't car…

Spf/dkim already authenticates the sender. But it doesn't help if the user doesn't check who the email is from. But in that case gpg would not help that much either.

There's little reason to think these emails didn't pass SPF/DKIM. They probably "legitimately" own their npmjs[.]help domain and whatever server they used to send the emails is probably approved by them to send for that domain.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#160

Post by udev4096 »

jve wrote: post #72
semiquaver wrote: post #29

Earlier quoted context omitted.

Passkeys are unphishable because there is nothing to type in. And they are locked to an origin by design, so you can’t accidentally use one on the wrong domain because the browser simply won’t do it.

... and they are not transferrable, tied to BigCorp & Friends.

It is on majority of selfhosted pw managers. Vaultwarden, most popular, can transfer passkeys
Post reply on HN