Oh no, not again a meditation on NPM supply chain attacks • Hacker News Board

Re: Oh no, not again a meditation on NPM supply chain attacks

#181

Post by dns_snek » Wed, Sep 17, 2025, 5:13 PM UTC

rs186 wrote: post #108

righthand wrote: post #69

Earlier quoted context omitted.

It’s NOT a stretch to blame Microsoft. How many billions have we spent chasing “AI”? These issues could have been easily solved if we spent the consideration on them. This has been going on well over a decade. Microsoft isn’t any better steward than the original teams. This issue has happened Plenty under Microsoft’s ownership.

Yeah, easily solved. Would love to hear your genius solutions right here that Microsoft is too dumb to come up with and implement.

Seriously? This is is extremely low hanging fruit that's not being taken care of. You shouldn't be able to take over a software dependency with a phishing email. Requiring simple PGP code signing or even just passkey authentication would eradicate that entire attack vector.

Future attacks would then require a level access of access that's already synonymous with "game over" for all intents and purposes (e.g. physical access, malware, or inside job). It's not bulletproof but it would be many orders of magnitude better than the current situation.

Re: Oh no, not again a meditation on NPM supply chain attacks

#182

Post by acdha » Wed, Sep 17, 2025, 5:19 PM UTC

a4isms wrote: post #140

acdha wrote: post #88

Earlier quoted context omitted.

This is funny but ultimately a mischaracterization of a popularity contest. Node culture is extreme–perhaps pathological–about using many dependencies to work around the limited standard library but the same kind of attacks happen everywhere people are releasing code. The underlying problem is that once you release something it takes only seconds before someone else can be running your code with full privileges to ac…

I think everything you're saying about the difference between school shootings and NPM supply chain attacks is correct, but at the same time "You made a joke about why A is like B, but here's why A and B are actually different, therefore the joke is not funny" is not persuasive. Comedy does not need to be rigorous, the person you're replying to is not arguing that supply chain attacks are like school shootings, there…

I chuckled, too, but I’m a Python developer and it’s not like this doesn’t happen there either. If you want the shorter version: “laugh after you’ve hardened your update process”.

Re: Oh no, not again a meditation on NPM supply chain attacks

#183

Post by acdha » Wed, Sep 17, 2025, 5:22 PM UTC

felixgallo wrote: post #116

acdha wrote: post #72

Earlier quoted context omitted.

They’re not the same problems. The Secure Enclave protects things like your biometrics, hardware-backed keys (e.g. on a Mac, WebAuthn and iCloud Keychain), and the integrity of the operating system but not every bit of code running as your account. That means that an NPM install can’t compromise your OS to the point that you can’t recover control, but it means the attacker can get everything you haven’t protected usi…

it's not clear that the solution to this problem is to create several additional layers of barn doors.

That doesn’t make sense: it’s like arguing that it wasn’t useful to have boat design switch to compartmentalization in addition to trying to avoid hitting things. You can spend a lot of effort trying to ensure bad code never arrives but unless that’s perfect you also want to think about how to make it less catastrophic.

Re: Oh no, not again a meditation on NPM supply chain attacks

#184

Post by JTbane » Wed, Sep 17, 2025, 5:29 PM UTC

nemomarx wrote: post #36

sarchertech wrote: post #28

Earlier quoted context omitted.

Just because you can do something doesn’t mean you should. There’s also lot of pressure for devs not to use licenses that restrict use by large companies. Try adding something to your license that says companies making over $10 million per year in revenue have to pay, and half of the comments on show HN will be open source warriors either asking why you didn’t use a standard license or telling you that this isn’t ope…

Sidestep this debate with one trick - use the GPLv3. No company large enough to have a legal team will be able to use it, you're still squarely within the various definitions, and the FSF basically has to approve. As a bonus maybe you can get some proprietary software open sourced too.

Companies are happy to use GPLv3 as long as they can put it behind a proprietary SaaS.

Re: Oh no, not again a meditation on NPM supply chain attacks

#185

Post by bapak » Wed, Sep 17, 2025, 5:46 PM UTC

hu3 wrote: post #113

My non-solution years ago was to use as little dependencies as possible. And vendor node_modules then review every line of code changed when I update dependencies. Not every project and team can do that. But when feasible, it's a strong mitigation layer. What worked was splitting dependency diff review among the team so it's less of a burden. We pin exact versions and update judiciously.

Good luck debugging wasm and other bins that are now more and more frequent (see tsgo)

Re: Oh no, not again a meditation on NPM supply chain attacks

#186

Post by leptons » Wed, Sep 17, 2025, 5:48 PM UTC

simonw wrote: post #106

2d8a875f-39a2-4 wrote: post #8

It's a stretch to pin blame on Microsoft. They're probably the reason the service is still up at all (TFA admits as much). In hindsight it's likely that all they wanted from the purchase was AI training material. At worst they're guilty of apathy, but that's no worse than the majority of npm ecosystem participants.

"In hindsight it's likely that all they wanted from the purchase was AI training material." Microsoft already owned GitHub. I don't see how acquiring npm would make a meaningful difference with respect to training material, especially since npm was already an open package repository which anyone could download without first buying the company.

Not all NPM packages are hosted on github. I don't know what the number is, but I know I don't have my NPM packages on github (instead, bitbucket).

Re: Oh no, not again a meditation on NPM supply chain attacks

#187

Post by righthand » Wed, Sep 17, 2025, 5:49 PM UTC

2d8a875f-39a2-4 wrote: post #97

righthand wrote: post #69

Earlier quoted context omitted.

It’s NOT a stretch to blame Microsoft. How many billions have we spent chasing “AI”? These issues could have been easily solved if we spent the consideration on them. This has been going on well over a decade. Microsoft isn’t any better steward than the original teams. This issue has happened Plenty under Microsoft’s ownership.

i would contend that they are no worse than the original teams, who also clearly didn't care. their motivations may have been growth rather than AI training data but the outcomes were the same

Microsoft has money to fix the problem is the difference. Neither side (og team, Microsoft, or npm consumers) has any capital interest in the matter.

Re: Oh no, not again a meditation on NPM supply chain attacks

#188

Post by righthand » Wed, Sep 17, 2025, 5:51 PM UTC

rs186 wrote: post #108

righthand wrote: post #69

Earlier quoted context omitted.

It’s NOT a stretch to blame Microsoft. How many billions have we spent chasing “AI”? These issues could have been easily solved if we spent the consideration on them. This has been going on well over a decade. Microsoft isn’t any better steward than the original teams. This issue has happened Plenty under Microsoft’s ownership.

Yeah, easily solved. Would love to hear your genius solutions right here that Microsoft is too dumb to come up with and implement.

Hate to tell ya but package signing is not a new problem and they could make it opt-in. There has been a Github issue and merge request submitted to enable it. But they were closed and denied. Malice or incompetence?

Hilarious that you think this is a some sort of impossible feat for a trillion dollar company.

Re: Oh no, not again a meditation on NPM supply chain attacks

#189

Post by marcosdumay » Wed, Sep 17, 2025, 6:06 PM UTC

sarchertech wrote: post #176

marcosdumay wrote: post #164

Earlier quoted context omitted.

> telling you that this isn’t open source Are you talking about promoting some software as open source when it's in fact not? Because yes, there's something wrong with that, you shouldn't do it, and people will rightfully react loudly if you try. People don't complain about proprietary software honestly communicated as that.

This is exactly the kind of thing, I’m talking about. Open source has mostly been captured by large corporations because purists refuse to recognize the gradient between proprietary and completely free. If I license my software as MIT but with an exception that you can’t use it for commercial purposes if you make more than $100 million a year in revenue, that’s a lot closer to open source than proprietary. We should…

Open source is open source. There exists no gradient there.

If your software isn't open source, don't claim it is. You are free to try to normalize your licensing preferences. Even better if you have a nice name for them that don't try to mislead people into thinking they are something they clearly aren't.

> I think the world would be a much better place if we just changed the definition of open source to include such licenses.

You are free to think that. I'm quite certain it's not correct, but nothing stops you. Anyway, you can make a positive change on the world you actually live on by being honest and clear about what your license does, and communicating why you think it's a good thing.

Again, it's a huge plus if you get some nice name that can actually mean the thing your license is.

> normal everyday use of the term would already include them

Normal and everyday use of "open source" does absolutely not include the licenses you are talking about.

Re: Oh no, not again a meditation on NPM supply chain attacks

#190

Post by watwut » Wed, Sep 17, 2025, 6:12 PM UTC

Ajedi32 wrote: post #154

watwut wrote: post #77

Earlier quoted context omitted.

> In a highly capitalized world, where share holder value is more worth than anything else, there are only a few companies that do the right call and act responsible. It is not just that. In a well functioning theoretical free market, no one is going to have time either. The margins are supposed to end up being tight and the competition is supposed to weed out economic inefficiency. Voluntary pro-social behavior is a…

Working an honest job is pro-social behavior, and it is rewarded. So is quitting your job to work on a side project that ends up being valuable enough for others to pay for. It's just that giving code away for free operates outside that reward structure.

First, in your breakdown, there is literally no space for unoaid volunteer work wich is topic of the thread.

Second, working job is about earning money not about helping others.