Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious npm packages detected across Red Hat Cloud Services

github.com

Post reply on HN
Print view View original

171–180 of 494 posts

Re: Malicious npm packages detected across Red Hat Cloud Services

#171

Post by IshKebab »

an0malous wrote: post #145
dns_snek wrote: post #64

Earlier quoted context omitted.

> since a bunch of people responding with "every package manager can be hit!!!" npm, by design, allows all packages to run package supplied arbitrary code as the logged-in user after an update completes. This is semi-common and in no way unique to NPM.

What other package managers do this? I don’t think Ruby does

Python does too I believe.

Really the reason not to allow that is for robustness, not security. You ideally don't want package installs doing random stuff to your system because package authors are generally bad at doing that sort of thing cleanly.

The security impact is relatively minimal because as other people have said, you just installed a package. What's the very next thing you're going to do? Compile/run it obviously.

Re: Malicious npm packages detected across Red Hat Cloud Services

#172

Post by n_e »

iconicBark wrote: post #137
grugdev42 wrote: post #131

The joke is on you NPM! I only use CDNs for my JS libraries.

Is this more secure?? I would genuinely love to know

Yes (assuming they're doing frontend dev and including the resources from the page). The code is fetched and executed from the browser, so It'll have to escape the browser sandbox to do something nefarious.

Re: Malicious npm packages detected across Red Hat Cloud Services

#173

Post by antiframe »

nailer wrote: post #63
Ancapistani wrote: post #32

Earlier quoted context omitted.

I didn’t take it that way at all - rather, Arch is the only one that does it “right” with the AUR.

If you want a usable system, you enable AUR. It's not 'doing it right', it's avoiding responsibility.

Depends on who 'you' are. I have one package I installed from the AUR and it's from a corporation that just repackages their builds. The problem is always who vets the packages. I trust the Arch team and I trust that one corporation. Also to use the AUR it's a different command, so I can't get surprised by an AUR package. It's not a pacman -Syu is going to pull in a new unknown to me AUR package.

Re: Malicious npm packages detected across Red Hat Cloud Services

#174

Post by westoque »

Someone1234 wrote: post #34
jofzar wrote: post #3

'No Way to Prevent This,' Says Only package manager Where This Regularly Happens Edit: some people don't understand that it's a defence to https://en.wikipedia.org/wiki/%27No_Way_to_Prevent_This,%27_...

Let me provide context, since a bunch of people responding with "every package manager can be hit!!!" npm, by design, allows all packages to run package supplied arbitrary code as the logged-in user after an update completes. That's an INSANE default. pnpm, by contrast, allows you to essentially "opt-in" only specific packages that need this (e.g. four out of thirty, in one of our projects). Then tacks on tons of oth…

i've been thinking about this as well. but having built a startup, i've learned that users don't care as long as they are given the value and most convenience. they don't really care much at security as much as we do. just look at openclaw? but maybe it's our job to make sure it is taken care of vs assuming the user cares and just make it look seamless.

Re: Malicious npm packages detected across Red Hat Cloud Services

#175

Post by duozerk »

rob_c wrote: post #114
dada216 wrote: post #82

Earlier quoted context omitted.

not really, no.

So why else do we pay someone to package and certify/verify open source projects? This is absolutely 90++% of what should be RedHats core day job.

Non-profit Open Source distributions also and already package and verify open source packages (arguably often with a higher quality of analysis than Red Hat).

You pay red hat for compliance reasons (availability of a support you'll never call, mostly).

Re: Malicious npm packages detected across Red Hat Cloud Services

#176

Post by sync »

king_zee wrote: post #40

I've made it a habit now to use the --before=2026-05-30 flag when installing packages, where it'll pick the version released before the date you specify, I usually pick around 5 days ago

If using straight npm (v11.10.0 or higher), you can just add to .npmrc in the project root:

min-release-age=5

Re: Malicious npm packages detected across Red Hat Cloud Services

#177

Post by runtime_terror »

bdcravens wrote: post #148
iconicBark wrote: post #137

Earlier quoted context omitted.

Is this more secure?? I would genuinely love to know

Yes, none of npm's lifecycle hooks. You're just pulling bytes over the wire.

Except now you're making http calls to remote servers that could be compromised.

Re: Malicious npm packages detected across Red Hat Cloud Services

#178

Post by lenerdenator »

Kuinox wrote: post #94
Someone1234 wrote: post #86

Earlier quoted context omitted.

I suppose. But that's a "Perfect is the enemy of good"-like argument. Wherein: Why even reduce an easy to exploit attack surface when there could be holes elsewhere?! Because, you know, it makes things much more secure even if imperfect. Plus, to me, it is a culture issue. npm just doesn't take security seriously, so we don't see these improvements, and if there was additional test hardening later, I don't expect we'…

The biggest problem is not software but culture, not at npm, but in the js ecosystem. The js ecosystem is simply a juicy targets, the attack surface is enormous. The attacker can make their attack more sophisticated, there will always be a maintainer that can seed the worm spread. Meanwhile in the nuget ecosystem is way smaller and have way less mainteners involved for a single given dependency.

I'd go further and say that how JS and the web itself has been run over the years has predisposed it to this sort of thing.

JS didn't have a passable stdlib until ES6. It had bugs built into it because Eich was given a stupidly short time window to deliver the first version. Everyone (particularly MS) had (and still sort of do) their own way of interpreting the language. In spite of all of this it became the primary way of developing applications for public consumption.

This led to a bunch of people who wanted to be the 10x JS engineer to solve problems with their own libraries and technologies. None of them really talked, they just threw their packages on NPM's registry without second thought and some gained widespread use just by accident.

Google tried fixing some of this with Dart but chickened out at the last second. TypeScript was designed by someone competent but can't fix the larger cultural issues.

This is what happens when you put SV hubris and "moving fast and breaking things" over doing things the right way.

Re: Malicious npm packages detected across Red Hat Cloud Services

#179

Post by exabrial »

mschuster91 wrote: post #132
general_reveal wrote: post #26

That’s why I switched to Java.

Meh maven plugins are just as juicy a target as npm is

https://github.com/s4u/pgpverify-maven-plugin

If you want paranoid mode, you can verify literally every part of the maven build process.

Post reply on HN