Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud Returns: Over 300 NPM Packages Infected

helixguard.ai

Post reply on HN
Print view View original

241–250 of 797 posts

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#241

Post by galangalalgol »

zenmac wrote: post #113
sph wrote: post #7

Earlier quoted context omitted.

It's not "node" or "Javascript" the problem, it's this convenient packaging model. This is gonna ruffle some feathers, but it's only a matter of time until it'll happen on the Rust ecosystem which loves to depend on a billion subpackages, and it won't be fault of the language itself. The more I think about it, the more I believe that C, C++ or Odin's decision not to have a convenient package manager that fosters a ca…

Just a last month someone was trying to figure the cargo tree on which Rust package got imported implicitly via which package. This will totally happen in rust as well as long as you use some kind of package manager. Go for zero or less decencies.

It already did happen. It propogated via build.rs as well. But as I said elsewhere, ut doesn't help you to forgo dependencies part of rust tooling itself.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#242

Post by pimterry »

gred wrote: post #74
Gigachad wrote: post #13

Earlier quoted context omitted.

The problem isn't specific to node. NPM is just the most popular repo so the most value for attacks. The same thing could happen on RubyGems, Cargo, or any of the other package managers.

NPM has about 4 million packages, Maven Central has about 3 million packages. If this were true, wouldn't there have been at least one Maven attack by now, considering the number of NPM attacks that we've seen?

As of 2024, Maven had 1.5 trillion requests annually vs npm's 4.5 trillion - regardless of package count, 3x more downloads in total does make it a very big target (numbers from https://www.sonatype.com/state-of-the-software-supply-chain/...).

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#243

Post by tonyedgecombe »

AndroTux wrote: post #88
gred wrote: post #74

Earlier quoted context omitted.

NPM has about 4 million packages, Maven Central has about 3 million packages. If this were true, wouldn't there have been at least one Maven attack by now, considering the number of NPM attacks that we've seen?

Okay then, explain to me why this is only possible with NPM? Does it have a hidden "pwn" button that I don't know about?

>Does it have a hidden "pwn" button that I don't know about?

Perhaps its package owners do.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#244

Post by zelphirkalt »

Ygg2 wrote: post #25
I_am_tiberius wrote: post #15

I guess you should never use the latest versions of libraries.

But you also need the latest versions to avoid zero-day attacks.

Zero-day on frontend has not really a y effect, except on one user at a time. Zero-day on a server though ... perhaps we arrive at the conclusion to not use the JS ecosystem on the server side.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#245

Post by hashstring »

rishabhaiover wrote: post #240

Why can't package managers enforce attestations backed by a transparent log for each commit made to a public repository?

They can, but what does it solve? If a malicious package gets pushed, who or what is the equivalent of the CA that you are you going to nuke?

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#246

Post by Ygg2 »

galangalalgol wrote: post #227
wongarsu wrote: post #100

Earlier quoted context omitted.

I wouldn't call the Rust stdlib "small". "Limited" I could agree with. On the topics it does cover, Rust's stdlib offers a lot . At least on the same level as Python, at times surpassing it. But because the stdlib isn't versioned it stays away from everything that isn't considered "settled", especially in matters where the best interface isn't clear yet. So no http library, no date handling, no helpers for writing ma…

Network without async works fine in std. However, rand, serde, and num_traits always seem to be present. Not sure why clap isn't std at this point.

> why clap isn't std at this point.

Too big for many cases, there is also a lot of discussion around whether to use clap, or something smaller.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#247

Post by pasc1878 »

metaltyphoon wrote: post #225
TheFlyingFish wrote: post #70

Earlier quoted context omitted.

I've worried about this for a while with Rust packages. The total size of a "big" Rust project's dependency graph is pretty similar to a lot of JS projects. E.g. Tauri, last I checked, introduces about 600 dependencies just on its own. Like another commenter said, I do think it's partially just because dependency management is so easy in Rust compared to e.g. C or C++, but I also suspect that it has to do with the si…

This is a reason why so many enterprises use C#. Most of the time you just use Microsoft made libraries and rarely brings in 3rd party.

Or purchase third party libraries. This does two things - limits what you drag in and also if you drag it in you can sue someone for errors.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#248

Post by bartmr »

codedokode wrote: post #207
junon wrote: post #193

Earlier quoted context omitted.

That's the goal, but it's not feasible in e.g. professional settings. Much easier said than done, unfortunately.

My code editor works in a sandbox. It's difficult because Linux doesn't provide it and one has to write it manually using shell scripts, random utilities. For example, I had also to write a limited FUSE emulation of /proc to allow code editor work without access to real /proc which contains lot of unnecessary information. And if it's a "professional" setting, the company could hire a part-time developer for writing t…

could you share with us those utilities? I've tried doing the same with AppArmor, but I ended up having endless warnings and weird bugs.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#249

Post by ashirviskas »

jhancock wrote: post #161

Is there a terminal AI assistant that doesn't have heaps of depenedancies and preferably no node? Claude and codex both require node. I'm a fan of the lightweight octofriend. But also node. I do not like installing node on systems that otherwise would not require it.

You can install codex without npm if you build it yourself, they have migrated to rust in June and npm is just a convenient install wrapper it seems.

Just `git clone git@github.com:openai/codex.git`, `cd codex-rs`, `cargo build --release` (If you have many cores and not much RAM, use `-j n`, where n is 1 to 4 to decrease RAM requirements)

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#250

Post by reconnecting »

fragmede wrote: post #99
weregiraffe wrote: post #48

Earlier quoted context omitted.

Building websites =/= Developing new technologies.

Yup! No new technologies have been invented or discovered thru building websites since CSS 1.0 in 1996.

Even worse! We lost along the way.
Post reply on HN