Related (7 days ago): NPM debug and chalk packages compromised (1366 points, 754 comments): https://news.ycombinator.com/item?id=45169657
Seems to be a separate incident?
Separate? Yes. Unrelated? Hard to tell.
Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
201–210 of 1001 posts
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#202This blog post and others are from 'security saas' that also try to make money off how bad NPM package security safety is.
Why can't npm maintainers just implement something similar?
Maybe at least have a default setting (or an option) that packages newer than X days are never automatically installed unless forced? That would at least give time for people to review and notice if the package has been compromised.
Also, there really needs to be a standard library or at least a central community approved library of safe packages for all standard stuff.
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#203I wonder who actually discovered this attack? Can we credit them? The phrasing in these posts is interesting, with some taking direct credit and others just acknowledging the incident. Aikido says: > We were alerted to a large-scale attack against npm... Socket says: > Socket.dev found compromised various CrowdStrike npm packages... Ox says: > Attackers slipped malicious code into new releases... Safety says: > The S…
Since so many vendors discovered these packages seemingly independently, you'd think that they would share those mechanisms with NPM itself so that those packages would never be published in the first place. But I guess that removes their ability to sell an "early alert" mechanism through their offerings...
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#204Earlier quoted context omitted.
> I'm coming to the unfortunate realizattion that supply chain attacks like this are simply baked into the modern JavaScript ecosystem. I see this odd take a lot - the automatic narrowing of the scope of an attack to the single ecosystem it occurred in most recently, without any real technical argument for doing so. What's especially concerning is I see this take in the security industry: mitigations put in place to…
I mostly agree. But NPM is special, in that the exposure is so much higher. The hypothetical python+htmx web app might have 10s of dependencies (including transitive) whereas your typical Javascript/React will have 1000s. All an attacker needs to do is find one of many packages like TinyColor or Leftpad or whatever and now loads of projects are compromised.
Stuff like Babel, React, Svelte, Axios, Redux, Jest… should be self contained and not depend on anything other than being a peer dependency. They are core technological choices that happens early in the project and is hard or impossible to replace afterwards.
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#205> Shai Hulud Clever name... but I would have expected malware authors to be a bit less obvious. They literally named their giant worm after a giant worm. > At the core of this attack is a ~3.6MB minified bundle.js file Yep, even malware can be bloated. That's in the spirit of NPM I guess...
Malwares have to follow Moore's law, tequila virus was ~2.6kb in 1991.
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#206npm considered harmful
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#207Earlier quoted context omitted.
AFAICT, the only thing this attack relies on, is the lack of scrutiny by developers when adding new dependencies. Unless this lack of scrutiny is exclusive to JavaScript ecosystem, then this attack could just as well have happened in Rust or Golang.
I don't know Go, but Rust absolutely has the same problem, yes. So does Python. NPM is being discussed here, because it is the topic of the article, but the issue is the ease with which you can pull in unvetted dependencies. Languages without package managers have a lot more friction to pull in dependencies. You usually rely on the operating system and its package-manager-humans to provide your dependencies; or on pr…
If you try installing npm itself on debian, you would think you are downloading some desktop environment. So many little packages.
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#208Earlier quoted context omitted.
> I'm coming to the unfortunate realizattion that supply chain attacks like this are simply baked into the modern JavaScript ecosystem. I see this odd take a lot - the automatic narrowing of the scope of an attack to the single ecosystem it occurred in most recently, without any real technical argument for doing so. What's especially concerning is I see this take in the security industry: mitigations put in place to…
I mostly agree. But NPM is special, in that the exposure is so much higher. The hypothetical python+htmx web app might have 10s of dependencies (including transitive) whereas your typical Javascript/React will have 1000s. All an attacker needs to do is find one of many packages like TinyColor or Leftpad or whatever and now loads of projects are compromised.
Well, your typical Rust project has over 1000 dependencies, too. Zed has over 2000 in release mode.
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#209Earlier quoted context omitted.
One that gets me 90% there would take me few hours, one that gets me 99% there few months, which is why eventually people would rather pull a dependency.
Or about 15 minutes with an LLM? https://github.com/williamcotton/markdown-to-html-llm ;)
I love how it took you very short to implement...the wrong thing.
> I myself just the other day had the task of converting HTML to markdown
> you could write an HTML to markdown library in half a day
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#210Earlier quoted context omitted.
And all those 5 remaining dependencies have lots of dependencies of their own. What's your point?
> What's your point? Just defending Rust. > 5 remaining dependencies have lots of dependencies of their own. Mostly well-known crates like rayon, crossbeam, tracing, etc.
You cannot defend Rust if this is reality.
Any Rust project I have ever compiled pulled in over 1000 dependencies. Recently it was Zed with its >2000 dependencies.