Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud Returns: Over 300 NPM Packages Infected

helixguard.ai

Post reply on HN
Print view View original

181–190 of 797 posts

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#181

Post by reconnecting »

embedding-shape wrote: post #169
reconnecting wrote: post #160

Earlier quoted context omitted.

I might say that every interpreter has a different minimum dependency level just to create a simple application. If we're talking about Node.js, there's a long list of dependencies by default. So yes, in comparison, modern vanilla PHP with some level of developer discipline (as you mentioned) is actually quite suitable, but unfortunately not popular, for low-dependency development of web applications.

> If we're talking about Node.js, there's a long list of dependencies by default. But that's not true? I initialize a project locally, there is zero dependencies by default, and like I did five years ago, I can still build backend/frontend projects with minimal set of dependencies. What changed is what people are willing/OK with doing. Yes, it'll require more effort, obviously, but if you want things to be built prop…

Perhaps, the right wording here might be that Node.js encourages the use of npm packages even for simple tasks.

I agree that in any case, it's the courage/discipline that comes before the language choice when creating low-dependency applications.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#182

Post by shortrounddev2 »

skwee357 wrote: post #122
vintagedave wrote: post #2

Serious question: should someone develop new technologies using Node any more? A short time ago, I started a frontend in Astro for a SaaS startup I'm building with a friend. Astro is beautiful. But it's build on Node. And every time I update the versions of my dependencies I feel terrified I am bringing something into my server I don't know about. I just keep reading more and more stories about dangerous npm packages…

I’m not a node/js apologist, but every time there is a vulnerability in NPM package, this opinion is voiced. But in reality it has nothing to do with node/js. It’s just because it’s the most used ecosystem. So I really don’t understand the argument of not using node. Just be mindful of your dependencies and avoid updating every day.

it's interesting that staying up to date with your dependencies is considered a vulnerability in Node

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#183

Post by moebrowne »

sublinear wrote: post #21
I_am_tiberius wrote: post #15

I guess you should never use the latest versions of libraries.

Not sure if you're serious, but if so I agree that people should take the time to set up their own package mirrors. Not just for npm but all other package managers as well. This is why it's so important to get to know what you're actually building instead of just "vibing" all the time. Before all the AI slop of this decade we just called it being responsible.

How does having a mirror help?

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#184

Post by yourapostasy »

GitHub back in September already published their roadmap of mitigations to NPM supply chain attacks:

https://github.blog/security/supply-chain-security/our-plan-...

I'm guessing no one yet wants to spend the money it takes for centralized, trusted testing where the test harnesses employ sandboxing and default-deny installs, Deterministic Simulated Testing (DST), or other techniques. And the sheer scale of NPM package modifications per week makes human in the loop-based defense daunting, to the point that only a small "gold standard" subset of packages that has a more reasonable volume of changes might be the only palatable alternative.

What are the thoughts of those deep inside the intersection of NPM and cybersecurity?

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#185

Post by skydhash »

sph wrote: post #123
tjpnz wrote: post #46

Earlier quoted context omitted.

In the early days the Node ecosystem adopted (from Unix) the notion that everything has to be its own micro package. Not only was there a failure to understand what it was actually talking about, but it was never a good fit for package management to begin with. I understand that there's been some course correction recently (zero dependency and minimal dependency libs), but there are still many devs who think that the…

> In the early days the Node ecosystem adopted (from Unix) the notion that everything has to be its own micro package. The medium is the message. If a language creates a very convenient package manager that completely eliminates the friction of sharing code, practically any permutation of code will be shared as a library. As productivity is the most important metric for most companies, devs will prefer the convenient…

It’s not even the convenience. It’s about trust. Npm makes it so that as soon as you add something to the dependency list, you trust the third party so completely you’re willing to run their code on your system as soon as they push an update.

It’s essentially remote execution a la carte.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#186

Post by _cenw »

gnfargbl wrote: post #95
sph wrote: post #7

Earlier quoted context omitted.

It's not "node" or "Javascript" the problem, it's this convenient packaging model. This is gonna ruffle some feathers, but it's only a matter of time until it'll happen on the Rust ecosystem which loves to depend on a billion subpackages, and it won't be fault of the language itself. The more I think about it, the more I believe that C, C++ or Odin's decision not to have a convenient package manager that fosters a ca…

I'm a huge Go proponent but I don't know if I can see much about Go's module system which would really prevent supply-chain attacks in practice. The Go maintainers point [1] at the strong dependency pinning approach, the sumdb system and the module proxy as mitigations, and yes, those are good. However, I can't see what those features do to defend against an attack vector that we have certainly seen elsewhere: projec…

The Go standard library is a lot more comprehensive and usable than Node, so you need less dependencies to begin with.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#187

Post by joshstrange »

blueflow wrote: post #176
joshstrange wrote: post #154

Earlier quoted context omitted.

That literally makes no difference at all. You’ll just vendor the malicious versions. No, a lock file with only exact versions is the safe path here. We haven’t seen a compromise to existing versions that I know of, only patch/minor updates with new malicious code. I maintain that the flexibility in npm package versions is the main issue here.

You are using the word "vendoring" differently than i do, i mean some kind of private fork of the repository.

You are using the word differently than everyone else I think. I’ve never heard someone using that word to mean maintain private forks. Then again, even private forks don’t protect you much more than package lock files and they are way more overhead IMHO.

You still need some out-of-band process to pull upstream updates and aside from a built-in “cool down” (until you merge changes) I see that method as having a huge amount of downside.

Yes, you sidestep malicious versions pushed to npm but now you own the build process for all your dependencies and you have to find time to update (and fix builds if they break) all your dependencies.

Locking to a specific version and waiting some period of time (cool down) before updating is way easier and jus as safe IMHO.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#188

Post by randomint64 »

sph wrote: post #7
vintagedave wrote: post #2

Serious question: should someone develop new technologies using Node any more? A short time ago, I started a frontend in Astro for a SaaS startup I'm building with a friend. Astro is beautiful. But it's build on Node. And every time I update the versions of my dependencies I feel terrified I am bringing something into my server I don't know about. I just keep reading more and more stories about dangerous npm packages…

It's not "node" or "Javascript" the problem, it's this convenient packaging model. This is gonna ruffle some feathers, but it's only a matter of time until it'll happen on the Rust ecosystem which loves to depend on a billion subpackages, and it won't be fault of the language itself. The more I think about it, the more I believe that C, C++ or Odin's decision not to have a convenient package manager that fosters a ca…

Indeed, Rust's supply chains story is an absolute horror, and there are countless articles explaining what should be done instead (e.g. https://kerkour.com/rust-stdx)

TL;DR: ditch crates.io and copy Go with decentralized packages based directly on and an extended standard library.

Centralized package managers only add a layer of obfuscation that attackers can use to their advantage.

On the other hand, C / C++ style dependency management is even worse than Rust's... Both in terms of development velocity and dependencies that never get updated.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#189

Post by skwee357 »

shortrounddev2 wrote: post #182
skwee357 wrote: post #122

Earlier quoted context omitted.

I’m not a node/js apologist, but every time there is a vulnerability in NPM package, this opinion is voiced. But in reality it has nothing to do with node/js. It’s just because it’s the most used ecosystem. So I really don’t understand the argument of not using node. Just be mindful of your dependencies and avoid updating every day.

it's interesting that staying up to date with your dependencies is considered a vulnerability in Node

People who live on the edge of updates always risk vulnerabilities and incompatibility issues. It’s not about node, but anything software related.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#190

Post by bichiliad »

shortrounddev2 wrote: post #182
skwee357 wrote: post #122

Earlier quoted context omitted.

I’m not a node/js apologist, but every time there is a vulnerability in NPM package, this opinion is voiced. But in reality it has nothing to do with node/js. It’s just because it’s the most used ecosystem. So I really don’t understand the argument of not using node. Just be mindful of your dependencies and avoid updating every day.

it's interesting that staying up to date with your dependencies is considered a vulnerability in Node

Having a cooldown is different from never updating. I don’t think waiting a few days is a bad security practice in any environment, node or otherwise.
Post reply on HN