Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud Returns: Over 300 NPM Packages Infected

helixguard.ai

Post reply on HN
Print view View original

251–260 of 797 posts

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#251

Post by phendrenad2 »

amiga386 wrote: post #224
codedokode wrote: post #191

Does NPM use any automatic scanners? Just scanning for eval/new Function/base64 and other tokens often used by malware, and requiring a manual review, could already help. Also package manager should not run scripts.

Static scanning won't help. You can write this["eval"]() instead of eval(), therefore you can write this["e" + "v" + "a" + "l"](), and you can substitute (!![]+[])[!+[]+!+[]+!+[]] for "e", (![]+[])[+!+[]] for "a" (and so on: https://jsfuck.com/ ) In this Turing-equivalent world, you can only know what actually executes (e.g. eval, fetch) by actually executing all code in the package and then see what functions got ex…

There's always some mathematician who tries to prove that locks on your doors "won't help" because the universe is infinite. Narrator: it is not

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#252

Post by bodash »

giantg2 wrote: post #220
bodash wrote: post #217

I compiled a list of NPM best practices one can adopt to reduce supply chain attack risks (even if there's no perfect security preventions, _always_): https://github.com/bodadotsh/npm-security-best-practices Discussion on HN last time: https://news.ycombinator.com/item?id=45326754

Do you know of anything similar for pip?

Most of the best practices can be translated to python ecosystem. It’s not exact 1:1 mapping but change few key terms and tools, the underlying practices should be the same.

Or copy that repo’s markdown into an llm and ask it to map to the pip ecosystem

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#253

Post by not_doctorq »

mittermayr wrote: post #79

I always (very naively, I fully get it) wonder if someone at GitHub could take a minute and check the logs (if there are any at this level) from a week ago or so and scan them for patterns? The code seems to grab a few files off of GitHub, use Github actions, etc. -- perhaps there's a pattern in there that shows the attacker experimenting and preparing for this? I assume most people at this level have VPNs and so for…

I have first hand knowledge that they do, or at least that the data exists and can be queried in that way, but it’s a game of cat and mouse.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#254

Post by wongarsu »

galangalalgol wrote: post #227
wongarsu wrote: post #100

Earlier quoted context omitted.

I wouldn't call the Rust stdlib "small". "Limited" I could agree with. On the topics it does cover, Rust's stdlib offers a lot . At least on the same level as Python, at times surpassing it. But because the stdlib isn't versioned it stays away from everything that isn't considered "settled", especially in matters where the best interface isn't clear yet. So no http library, no date handling, no helpers for writing ma…

Network without async works fine in std. However, rand, serde, and num_traits always seem to be present. Not sure why clap isn't std at this point.

Clap went through some major redesigns with the 4.0 release just three years ago. That wouldn't have been possible if clap 2.0 or 3.0 had been added to the stdlib. It's almost a poster child for things where libraries where being outside the stdlib allows interface improvements (date/time handling would be the other obvious example).

Rand has the issue of platform support for securely seeding a secure rng, and having just an unsecure rng might cause people to use it when they really shouldn't. And serde is near-universal but has some very vocal opponents because it's such a heavy library. I have however often wished that num_traits would be in the stdlib, it really feels like something that belongs in there.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#256

Post by das_keyboard »

Slightly OT, but who is HelixGuard?

The website is a mess (broken links, broken UI elements, no about section)

There is no history on webarchive. There is no information outside of this website and their "customers" are crypto exchanges and some japanese payment provider.

This seems a bit fishy to me - or am I too paranoid?

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#257

Post by jml78 »

amiga386 wrote: post #172
AndroTux wrote: post #93

Earlier quoted context omitted.

Okay then, tell me a way to prevent this.

An example: Java Maven artifacts typically name the exact version of their dependencies. They rarely write "1.2.3 or any newer version in the 1.2.x series ", as is the de-facto standard in NPM dependencies. Therefore, it's up to each dependency-user to validate newer versions of dependencies before publishing a new version of their own package. Lots of manual attention needed, so a slower pace of releases. This is a…

You forgot to mention it is also tied to provable namespaces. People keep saying that NPM is just the biggest target...

Hate to break it to you but from targeting enterprises, java maven artifacts would be a MASSIVE target. It is just harder to compromise because NPM is such shit.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#259

Post by Ygg2 »

randomint64 wrote: post #188
sph wrote: post #7

Earlier quoted context omitted.

It's not "node" or "Javascript" the problem, it's this convenient packaging model. This is gonna ruffle some feathers, but it's only a matter of time until it'll happen on the Rust ecosystem which loves to depend on a billion subpackages, and it won't be fault of the language itself. The more I think about it, the more I believe that C, C++ or Odin's decision not to have a convenient package manager that fosters a ca…

Indeed, Rust's supply chains story is an absolute horror, and there are countless articles explaining what should be done instead (e.g. https://kerkour.com/rust-stdx ) TL;DR: ditch crates.io and copy Go with decentralized packages based directly on and an extended standard library. Centralized package managers only add a layer of obfuscation that attackers can use to their advantage. On the other hand, C / C++ style…

> countless articles explaining what should be done instead (e.g. https://kerkour.com/rust-stdx)

Don't make me tap the sign: https://news.ycombinator.com/item?id=41727085#41727410

> Centralized package managers only add a layer of obfuscation that attackers can use to their advantage.

They add a layer of convenience. C/C++ are missing that convenience because they aren't as composable and have a long tail of pre-package manager projects.

Java didn't start with packages, but today we have packages. Same with JS, etc.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#260

Post by FergusArgyll »

trollbridge wrote: post #167
viraptor wrote: post #87

Earlier quoted context omitted.

It's not the packaging tech. Apt will typically mean a Debian-based distro. That means the packages are chosen by the maintainers and updated only during specific time periods and tested before release. Even if the underlying software gets owned and replaced, the distro package is very unlikely to be affected. (Unless someone spent months building trust, like xz) But the basic takeover... no, it usually won't affect…

Given the years (or decades) it takes updates to happen in Debian stable, it’s immune to supply chain attacks. You do get to enjoy vulnerabilities that have been out for years, though.

Security updates are basically immediate, even on stable flavors
Post reply on HN