I knew npm was a train wreck when I first used it years ago and it pulled in literally hundreds of dependencies for a simple app. I avoid anything that uses it like the plague.
So basically you live JavaScript free?
[deleted]
Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
151–160 of 1001 posts
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#152Earlier quoted context omitted.
Or about 15 minutes with an LLM? https://github.com/williamcotton/markdown-to-html-llm ;)
In less time than that, you could `git clone` the desired open source package, and text search & replace the author's name with your own.
And then still be subject to supply-chain attacks with all of the dependencies in whatever open source package you're cloning?
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#153As a developer, is there a way on mac to limit npm file access to the specific project? So that if you install a compromised package it cannot access any data outside of your project directory?
Frankly, I am refusing to use npm outside of docker anymore.
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#154This happens because there's no auditing of new packages or versions. The distro's maintainer and the developer is the same person. The general solution is to do what Debian does. Keep a stable distro where new packages aren't added and versions change rarely (security updates and bugfixes only, no new functionality). This is what most people use. Keep a testing/unstable distro where new packages and new versions can…
Exactly, in a way Debian (or any other distro) is an extended standard library.
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#155I'm coming to the unfortunate realizattion that supply chain attacks like this are simply baked into the modern JavaScript ecosystem. Vendoring can mitigate your immediate exposure, but does not solve this problem. These attacks may just be the final push I needed to take server rendering (without js) more seriously. The HTMX folks convinced me that I can get REALLY far without any JavaScript, and my apps will probab…
Until you go get malware Supply chain attacks happen at every layer where there is package management or a vector onto the machine or into the code. What NPM should do if they really give a shit is start requiring 2FA to publish. Require a scan prior to publish. Sign the package with hard keys and signature. Verify all packages installed match signatures. Semver matching isn’t enough. CRC checks aren’t enough. This h…
NPM does require 2FA to publish. I would love a workaround! Isn't it funny that even here on HN, misinformation is constantly being spread?
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#156When the left-pad debacle happened, one commenter here said of a well known npm maintainer something to the effect of that he's an "author of 600 npm packages, and 1200 lines of JavaScript". Not much has changed since then. The best counter-example I know is esbuild, which is a fully featured bundler/minifier/etc that has zero external dependencies except for the Go stdlib + one package maintained by the Go project i…
Yes, eslint is particularly frustrating: https://npmgraph.js.org/?q=eslint
There are plenty of people in the community who would help reduce the number of dependencies, but it really requires the maintainers to make it a priority. Otherwise the only way to address it is to switch to another solution like oxlint.
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#157Earlier quoted context omitted.
> Until you go get malware While technically true, I have yet to see Go projects importing thousands of dependencies. They may certainly exist, but are absolutely not the rule. JS projects, however... We have to realize, that while supply chain attacks can happen everywhere, the best mitigations are development culture and solid standard library - looking at you, cargo. I am a JS developer by trade and I think that t…
Here's an example off the top of my mind: https://github.com/go-gitea/gitea/blob/main/go.sum
I think you are reading that wrong, go.sum isn't a list of dependencies it's a list of checksums for modules that were, at some point, used by this module. All those different versions of the same module listed there, they aren't all dependencies, at most one of them is.
Assuming 'go mod tidy' is periodically run go.mod should contain all dependencies (which in this case seems to be shy of 300, still a lot).
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#158Earlier quoted context omitted.
Until you go get malware Supply chain attacks happen at every layer where there is package management or a vector onto the machine or into the code. What NPM should do if they really give a shit is start requiring 2FA to publish. Require a scan prior to publish. Sign the package with hard keys and signature. Verify all packages installed match signatures. Semver matching isn’t enough. CRC checks aren’t enough. This h…
If NPM really cared, they'd stop recommending people use their poorly designed version control system that relies on late-fetching third-party components required by the build step, and they'd advise people to pick a reliable and robust VCS like Git for tracking/storing/retrieving source code objects and stick to that. This will never happen. NPM has also been sending out nag emails for the last 2+ years about 2FA. I…
NPM lock files seem to include hashes for integrity checking, so as long as you check the lock file into the VCS, what's the difference?
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#159Related (7 days ago):
NPM debug and chalk packages compromised (1366 points, 754 comments): https://news.ycombinator.com/item?id=45169657
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#160Jesus Christ. Another one? What the fuck?
This isn't a JavaScript problem. What, structurally, stops the same thing happening to PyPI? Or the Rust ecosystem? Or Lisp via QuickLisp? Or CPAN?
This whole mess was foreseeable. So what's to be done?
Look. Any serious project needs to start vendoring its dependencies. People should establish big, coarse grained meta-distributions like C++ Boost that come from a trustable authority and that get updated infrequently enough that you can keep up with release notes.