Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM flooded with malicious packages downloaded more than 86k times

arstechnica.com

Post reply on HN
Print view View original

251–260 of 308 posts

Re: NPM flooded with malicious packages downloaded more than 86k times

#251

Post by michaelcampbell »

The_President wrote: post #223
ghusto wrote: post #5

When people ask me what's so wrong with lowering the bar of entry for engineering, I point to things like this.

Engineering used as a title should be regulated in the software industry; it was always a title reserved for a role that requires accountability. In software, it became used so casually without legal restriction that full stack developers started using it.

This is most often pushed on the person by their company. I don't have an Eng degree nor certification, but my company forces my title to be "... Engineer", which I dislike, but I've been told this is just how it is.

Re: NPM flooded with malicious packages downloaded more than 86k times

#252

Post by scuff3d »

codedokode wrote: post #155
scuff3d wrote: post #140

Earlier quoted context omitted.

One of the biggest things that pushes me away from Rust is the reliance on micro dependencies. It's a terrible model.

What's wrong with micro dependencies? Isn't it better to download only the code you need? Also it makes refactoring easier, and enforces better architecture.

No, I'd much rather a trusted source, like the language developers themselves, provide as much as possible.

And those last two points have absolutely nothing to do with micro dependencies one way or the other.

Re: NPM flooded with malicious packages downloaded more than 86k times

#253

Post by immibis »

codedokode wrote: post #194
immibis wrote: post #193

Earlier quoted context omitted.

It just has Linux user IDs. They're in every Linux.

I think that was long time ago, because this doesn't allow to request permissions in runtime.

Permissions are not granted through Linux itself. Permissions are something checked by separate processes when you connect with those processes.

Re: NPM flooded with malicious packages downloaded more than 86k times

#254

Post by redat00 »

ashishb wrote: post #58

Here's my `npm` command these days. It reduces the attack surface drastically. alias npm='docker run --rm -it -v ${PWD}:${PWD} --net=host --workdir=${PWD} node:25-bookworm-slim npm' - No access to my env vars - No access to anything outside my current directory (usually a JS project). - No access to my .bashrc or other files. Ref: https://ashishb.net/programming/run-tools-inside-docker/

Doesn't Docker run as `root` by default, and alter the permission of your folder by taking ownership and making it as `root:root` ?

Re: NPM flooded with malicious packages downloaded more than 86k times

#255

Post by redat00 »

redat00 wrote: post #254
ashishb wrote: post #58

Here's my `npm` command these days. It reduces the attack surface drastically. alias npm='docker run --rm -it -v ${PWD}:${PWD} --net=host --workdir=${PWD} node:25-bookworm-slim npm' - No access to my env vars - No access to anything outside my current directory (usually a JS project). - No access to my .bashrc or other files. Ref: https://ashishb.net/programming/run-tools-inside-docker/

Doesn't Docker run as `root` by default, and alter the permission of your folder by taking ownership and making it as `root:root` ?

Just tested it and apparently it's not the case, neat!

Re: NPM flooded with malicious packages downloaded more than 86k times

#256

Post by ivankra »

suck-my-spez wrote: post #37
numbsafari wrote: post #27

Earlier quoted context omitted.

Don't do development on your local machine. Full stop. Just don't. Do development, all of it, inside VMs or containers, either local or remote. Use ephemeral credentials within said VMs, or use no credentials. For example, do all your git pulls on your laptop directly, or in a separate VM with a mounted volume that is then shared with the VM/containers where you are running dev tooling. This has the added benefit of…

Are people actually using UTM to do local development? Im genuinely curious because I casually looked into it so that i could work on some hobby stuff over lunch on my work machine. However I just assumed the performance wouldn't be too great. Would love to hear how people are setup…

It works incredibly well with Linux VMs, my daily driver. I plug in a USB keyboard, external monitor and Can't Believe It's Not Linux. Only occasionally when I need to use the laptop screen/keyboard does macOS bother me and remind of it real self.

There's around 10-15% performance penalty for VMs (assuming you use arm64 guests), but the whole system is just so much faster and well built than anything Intel-based to day, that it more than compensates.

For Windows, it's lacking accelerated video drivers, but VMWare Fusion is an ok free alternative - I can totally play AAA games from last decade. Enjoy it until broadcom kills it.

Re: NPM flooded with malicious packages downloaded more than 86k times

#257

Post by TacticalCoder »

a022311 wrote: post #239
ashishb wrote: post #58

Here's my `npm` command these days. It reduces the attack surface drastically. alias npm='docker run --rm -it -v ${PWD}:${PWD} --net=host --workdir=${PWD} node:25-bookworm-slim npm' - No access to my env vars - No access to anything outside my current directory (usually a JS project). - No access to my .bashrc or other files. Ref: https://ashishb.net/programming/run-tools-inside-docker/

Not sure how secure this really is, because it's fairly easy to break out of a Docker container with the default settings (due to the fact that the kernel is shared between containers and the host, unlike with VMs). Rootless Docker (or better, Podman) would improve security greatly.

[dead]

Re: NPM flooded with malicious packages downloaded more than 86k times

#258

Post by lioeters »

dns_snek wrote: post #195
ashishb wrote: post #58

Here's my `npm` command these days. It reduces the attack surface drastically. alias npm='docker run --rm -it -v ${PWD}:${PWD} --net=host --workdir=${PWD} node:25-bookworm-slim npm' - No access to my env vars - No access to anything outside my current directory (usually a JS project). - No access to my .bashrc or other files. Ref: https://ashishb.net/programming/run-tools-inside-docker/

This folk-wisdom scapegoating of post-install scripts needs to stop or people are going to get really hurt by the false sense of security it's creating. I can see the reasoning behind this, I really do, it sounds convincing but it's only half the story. If you want to protect your machine from malicious dependencies you must run everything in a sandbox all the time, not just during the installation phase. If you foll…

You're right, it's not just about post-install scripts nor NPM and JavaScript. This is a deep fundamental issue in software development practices across most programming language ecosystems. And not only open-source, since proprietary code is often even worse about vetting dependencies. More eyes are better, therefore open source (or source available) is a prerequisite for security.

Improving NPM's processes, having more companies auditing packages, changing the way NPM the tool works - that's all good but far from enough, it doesn't actually address the root vulnerability, which is that we're way too comfortable running other people's arbitrary code.

Containerization and strict permissions system by default seem to be where we're headed.

Re: NPM flooded with malicious packages downloaded more than 86k times

#259

Post by johnisgood »

alt227 wrote: post #236
brabel wrote: post #179

Earlier quoted context omitted.

Oh man you pick the one other language that followed the JavaScript model?! How about C, Java, Go, Lisp, C#, C++, D… and new ones like Odin that are explicitly against package managers for this very reason.

When you start writing with C, where do you get your stdio.h file? Do you write it yourself, or inspect it line by line every time or do you trust the installation package you just ran?

Your OS. glibc / musl.

Re: NPM flooded with malicious packages downloaded more than 86k times

#260

Post by joshkel »

azangru wrote: post #197
ashishb wrote: post #76

Earlier quoted context omitted.

> Also I can recommend pnpm, it has stopped executing lifecycle scripts by default so you can whitelist which ones to run. Imagine you are in a 50-person team that maintains 10 JavaScript projects, which one is easier? - Switch all projects to `pnpm`? That means switching CI, and deployment processes as well - Change the way *you* run `npm` on your machine and let your colleagues know to do the same I find the second…

> which one is easier? > Switch all projects to `pnpm`? Sorry; I am out of touch. Does pnpm not have these security problems? Do they only exist for npm?

pnpm doesn't execute lifecycle scripts by default, so it avoids the particular attack vector of "simply downloading and installing an NPM package allows it to execute malicious code."

As phiresky points out, you're still "download[ing] arbitrary code you are going to execute immediately afterwards" (in many/most cases), so it's far from foolproof, but it's sufficient to stop many of the attacks seen in the wild. For example, it's my understanding that last month's Shai-Hulud worm depended on postinstall scripts, so pnpm's restriction of postinstall scripts would have stopped it (unless you whitelist the scripts). But last month's attack on chalk, debug, et al. only involved runtime code, so measures like pnpm's would not have helped.

Post reply on HN