Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

socket.dev

Post reply on HN
Print view View original

241–250 of 1001 posts

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#241

Post by galaxyLogic »

kortilla wrote: post #188
jeswin wrote: post #167

Earlier quoted context omitted.

Traditional JS is actually among the safest environments ever created. Every day, billions of devices run untrusted JS code, and no other platform has seen sandboxed execution at such scale. And in nearly three decades, there have been very few incidents of large successful attacks on browser engines. That makes the JS engine derived from browsers the perfect tool to build a server side framework out of. However, pro…

None of those security guarantees matter when you take out the sandbox, which is exactly what server-side JS does. The isolated context is gone and a single instance of code talking to an individual client has access to your entire database. It’s a completely different threat model.

So maybe the solution would be to sandbox Node.js?

I'm not quite sure what that would mean, but if it solves the problem for browsers, why not for server?

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#242

Post by williamcotton »

williamcotton wrote: post #217
epolanski wrote: post #209

Earlier quoted context omitted.

I love how it took you very short to implement...the wrong thing. > I myself just the other day had the task of converting HTML to markdown > you could write an HTML to markdown library in half a day

LOL! Good point, my friend.

Claude Code just added support for HTML to Markdown. Seems to work?

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#243

Post by __alexs »

rs999gti wrote: post #238
codemonkey-zeta wrote: post #31

I'm coming to the unfortunate realizattion that supply chain attacks like this are simply baked into the modern JavaScript ecosystem. Vendoring can mitigate your immediate exposure, but does not solve this problem. These attacks may just be the final push I needed to take server rendering (without js) more seriously. The HTMX folks convinced me that I can get REALLY far without any JavaScript, and my apps will probab…

> supply chain attacks You all really need to stop using this term when it comes to OSS. Supply chain implies a relationship, none of these companies or developers have a relationship with the creators other than including their packages. Call it something like "free code attacks" or "hobbyist code attacks."

I know CrowdStrike have a pretty bad reputation but calling them hobbyists is a bit rude.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#244

Post by orbital-decay »

cxr wrote: post #118
hsbauauvhabzb wrote: post #62

Earlier quoted context omitted.

JavaScript does have some pretty insane dependency trees. Most other languages don’t have anywhere near that level of nestedness.

It's not possible for a language to have an insane dependency tree. That's an attribute of a codebase.

Modern programming languages don't exist in a vacuum, they are tied to the existing codebase and libraries.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#245

Post by shermantanktop »

rs999gti wrote: post #238
codemonkey-zeta wrote: post #31

I'm coming to the unfortunate realizattion that supply chain attacks like this are simply baked into the modern JavaScript ecosystem. Vendoring can mitigate your immediate exposure, but does not solve this problem. These attacks may just be the final push I needed to take server rendering (without js) more seriously. The HTMX folks convinced me that I can get REALLY far without any JavaScript, and my apps will probab…

> supply chain attacks You all really need to stop using this term when it comes to OSS. Supply chain implies a relationship, none of these companies or developers have a relationship with the creators other than including their packages. Call it something like "free code attacks" or "hobbyist code attacks."

“code I picked up off the side of the road”

“code I somehow took a dependency on when copying bits of someone’s package.json file”

“code which showed up in my lock file and I still don’t know how it got there”

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#246

Post by tomjen3 »

tarruda wrote: post #57
codemonkey-zeta wrote: post #31

I'm coming to the unfortunate realizattion that supply chain attacks like this are simply baked into the modern JavaScript ecosystem. Vendoring can mitigate your immediate exposure, but does not solve this problem. These attacks may just be the final push I needed to take server rendering (without js) more seriously. The HTMX folks convinced me that I can get REALLY far without any JavaScript, and my apps will probab…

AFAICT, the only thing this attack relies on, is the lack of scrutiny by developers when adding new dependencies. Unless this lack of scrutiny is exclusive to JavaScript ecosystem, then this attack could just as well have happened in Rust or Golang.

That, and the ability to push an update without human interaction.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#247

Post by hombre_fatal »

Meneth wrote: post #91

This happens because there's no auditing of new packages or versions. The distro's maintainer and the developer is the same person. The general solution is to do what Debian does. Keep a stable distro where new packages aren't added and versions change rarely (security updates and bugfixes only, no new functionality). This is what most people use. Keep a testing/unstable distro where new packages and new versions can…

The problem with your idea is that you need to find the person who wants to do all this auditing of every version of Node/Python/Ruby libraries.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#248

Post by pclmulqdq »

zachrip wrote: post #119
lithos wrote: post #83

Earlier quoted context omitted.

Just more engineering leaning than you. Actual engineers have to analyze their supply chains, and so makes sense they would be baffled by NPM dependency trees that utterly normal projects grow into in the JavaScript ecosystem.

Do you think companies using node don't analyze supply chains? That's nonsense. Have you cargo installed a rust app recently? This isn't just a js issue. This needs to be solved across the industry and npm frankly has done a horrible job at it. We let people with billions of downloads a month with recently changed password/2fa publish packages? Why don't we pool assets as a collective to scan newly published packages…

It is solved across the industry for those who care. If you use cargo, npm, or a python package manager, you may have a service that handles static versioning of dependencies for security purposes. If you don't, you aren't generally working in a language that encourages so much package use.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#249

Post by mdaniel »

paulddraper wrote: post #225
Meneth wrote: post #91

This happens because there's no auditing of new packages or versions. The distro's maintainer and the developer is the same person. The general solution is to do what Debian does. Keep a stable distro where new packages aren't added and versions change rarely (security updates and bugfixes only, no new functionality). This is what most people use. Keep a testing/unstable distro where new packages and new versions can…

Go’s package repository is just GitHub. At the end of the day, it’s all a URL. You’re asking for a blessed set of URLs. You’d have to convince someone to spend time maintaining that.

As hair splitting, that's actually not true: Go's package manager is just version control of which GitHub is currently the most popular hosting. And it also allows redirecting to your own version control via `go mod edit -replace` which leaves the sourcecode reference to GitHub intact, but will install it from wherever you like

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#250

Post by advocatemack »

cddotdotslash wrote: post #170

I wonder who actually discovered this attack? Can we credit them? The phrasing in these posts is interesting, with some taking direct credit and others just acknowledging the incident. Aikido says: > We were alerted to a large-scale attack against npm... Socket says: > Socket.dev found compromised various CrowdStrike npm packages... Ox says: > Attackers slipped malicious code into new releases... Safety says: > The S…

Mackenzie here I work for Aikido. This is a classic example of the security community all playing a part. The very first notice of this was from a developer named Daniel Pereira. He alerted Socket who did the first review of the Malware and discovered 40 packages. After, Aikido discovered an additional 147 packages and the Crowdstrike packages. I'm not sure how Step found it but they were the first to really understand the malware and that it was a self replicating worm. So multiple parties all playing a part kinda independent. Its pretty cool
Post reply on HN