As similar to 1st wave of Shai Hulud, this also got it through opentionalDependency. intresting
Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised
21–30 of 329 posts
Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised
#22> Docker Container Escape > The payload checks for the Docker socket and, if present, attempts container escape through three sequential methods: So even if you're running devcontainers / VMs, these worms are already trying to escape. Make sure you're running a rootless VM engine (e.g. podman instead of docker) !
Or don't mount the Docker socket into containers
Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised
#23Earlier quoted context omitted.
how do containers solve the problem? if they are connected to the internet (and they are) you have got the same problem, if the credentials can be read by the container, at least to my understanding
For credential stealing, that is true, but at least it would protect your local machine. But I just read these worms also try container escape ...
You need to use full isolated VM with its own kernel. But then again, I've read somewhere that this malware is also trying to escape the VM isolation as well...
Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised
#24Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised
#25Another day, another pre/postinstall script executed that could have easily have been prevented by any sane package manager. NPM really desperately needs an 'allowBuilds' style allowlist [1] and 'approve-builds' command [2]. 1. https://pnpm.io/settings#allowbuilds 2. https://pnpm.io/cli/approve-builds
After I upgraded pnpm to v11, I set all allowBuilds to false and have not observed any failures. Made me wonder why the packages even need build scripts. My guess is for obscure or old platforms, but for most users running on Linux or Darwin build scripts seem to be unnecessary.
Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised
#26> Docker Container Escape > The payload checks for the Docker socket and, if present, attempts container escape through three sequential methods: So even if you're running devcontainers / VMs, these worms are already trying to escape. Make sure you're running a rootless VM engine (e.g. podman instead of docker) !
> Make sure you're running a rootless VM engine (e.g. podman instead of docker) ! Aren't most people running docker rootless (at least on Linux)? Does podman do more?
The docker CLI tool is normally executed with user privileges, but there's dockerd, a daemon running as root that actually does the container execution.
Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised
#27> Docker Container Escape > The payload checks for the Docker socket and, if present, attempts container escape through three sequential methods: So even if you're running devcontainers / VMs, these worms are already trying to escape. Make sure you're running a rootless VM engine (e.g. podman instead of docker) !
> Make sure you're running a rootless VM engine (e.g. podman instead of docker) ! Aren't most people running docker rootless (at least on Linux)? Does podman do more?
docker service that sets up containers runs as root. podman does away with that service.
Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised
#28In the fictional universe of William Gibson's Sprawl trilogy, it is legal and normal for defenders to go kinetic on cyberattackers. How long until it is simply easier for governments and big business in the countries victimised by these criminal groups, to find the path of least resistance and go after them personally?
Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised
#29If you think about it, this is actually a new kind of security. Security by numbers. Overwhelm the attackers with so many compromised services and devices that they get a reverse denial of service. It's inspired by nature in herd animals.
Security by giving up
Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised
#30In the fictional universe of William Gibson's Sprawl trilogy, it is legal and normal for defenders to go kinetic on cyberattackers. How long until it is simply easier for governments and big business in the countries victimised by these criminal groups, to find the path of least resistance and go after them personally?
We can’t even prevent shop lifting.