Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

github.com

Post reply on HN
Print view View original

261–270 of 296 posts

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#261

Post by Moru »

feross wrote: post #189
elric wrote: post #74

This is critical infrastructure, and it gets compromised way too often. There are so many horror stories of NPM (and similar) packages getting filled with malware. You can't rely on people not falling for phishing 100% of the time. People who publish software packages tend to be at least somewhat technical people. Can package publishing platforms PLEASE start SIGNING emails. Publish GPG keys (or whatever, I don't car…

Disclosure: I’m the founder of https://socket.dev We analyzed this DuckDB incident today. The attacker phished a maintainer on npmjs.help, proxied the real npm, reset 2FA, then immediately created a new API token and published four malicious versions. A short publish freeze after 2FA or token changes would have broken that chain. Signed emails help, but passkeys plus a publish freeze on auth changes is what would hav…

Some registrars make this easy. Think it was cloudflare that has a button for "Do not allow email from this domain". Saw it last time I set up a domain that I didn't want to send email from. I'm guessing you get that question if there is no MX records for the domain when you move to cloudflare.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#262

Post by cindyllm »

zahlman wrote: post #259
JimDabell wrote: post #228

Earlier quoted context omitted.

So if an organisation emails you from no-reply@notifications.example.com, mailing-list@examplemail.com, and bob.smith@examplecorp.com, and the phisher emails you from support@example.help, which filter based on their from addresses makes all the legitimate ones show up as the same sender while excluding the phishing email?

> which filter based on their from addresses makes all the legitimate ones show up as the same sender while excluding the phishing email? This is the wrong question. The right question is: what should we do about the fact that the organization has such terrible security practice? And the answer is: call them on the phone, and tell them that you will not do business with them until they fix their shit.

[dead]

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#263

Post by Moru »

SoftTalker wrote: post #94
elric wrote: post #74

This is critical infrastructure, and it gets compromised way too often. There are so many horror stories of NPM (and similar) packages getting filled with malware. You can't rely on people not falling for phishing 100% of the time. People who publish software packages tend to be at least somewhat technical people. Can package publishing platforms PLEASE start SIGNING emails. Publish GPG keys (or whatever, I don't car…

I think you just have to distrust email (or any other "pushed" messages), period. Just don't ever click on a link in an email or a message. Go to the site from your own previously bookmarked shortcut, or type in the URL. I got a fraud alert email from my credit card the other day. It included links to view and confirm/deny the suspicious charge. It all looked OK, the email included my name and the last digits of my a…

There is companies that send email with invoices where you have to click a link. There is no way of logging in on their site to get to the invoice. It is an easy fix for them (we use the same invoicing company as they do so I know). All they need to do is click "Allow sending bills directly to customers bank". Every month I get the email, I use the included chat function on the webpage to ask when they will enable this and it's always not possible. Mabe some day.

I wish we could stop training people to click links in random messages just because we want to be able to track their movements online.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#264

Post by Moru »

sgc wrote: post #181
sroussey wrote: post #158

Earlier quoted context omitted.

I get Coinbase SMS all the time with a code not to share. But also… “call this phone number if you did not request the code”.

This does nothing for the case of receiving a fake coinbase sms with a fake contact phone number. I have had people attempt fraud in my work with live calls as follow up to emails and texts. I only caught it because it didn't pass the smell test so I did quite a bit of research. Somebody else got caught in the exact same scam and I had to extricate them from it. They didn't believe me at first and I had to hit them o…

Yes, this is a classic scam vector. We really should stop training users to click links / call phonenumbers in sms and emails.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#265

Post by zahlman »

throwaway127482 wrote: post #143
vitonsky wrote: post #137

Just for context. DuckDB team is consistently ignores any security practices. The single one method how to install DuckDB on laptop is to run `curl https://install.duckdb.org | sh` I've requested to deliver CLI as standard package, they have ignored it. Here is the thread https://github.com/duckdb/duckdb/issues/17091 As you can see that it isn't single slip due to "human factor", but DuckDB management consistently pu…

Genuine question: why is `curl https://trusted-site.com | sh` a security risk? Fundamentally, doesn't the security depend entirely on whether https is working properly? Even the standard package repos are relying on https right? Like, I don't see how it's different than going to their website, copying their recommended command to install via a standard repo, then pasting that command into your shell. Either way, you…

> Like, I don't see how it's different than going to their website, copying their recommended command to install via a standard repo, then pasting that command into your shell.

Suppose the site got compromised. If you separately explicitly download the install script first, in principle you can review it before running it.

Same deal with installing Python source packages (sdists). Arbitrary code included in the package runs at installation time (with the legitimate purpose of orchestrating any needed build steps, especially for non-Python code, which could be arbitrarily complex). This is worse than importing the installed code and letting it run whatever top-level code, because the entire installation is normally automated and there's no point where you review the code before proceeding. We do generally accept this risk in the Python ecosystem, but demanding to install only from pre-built wheels is safer (it just isn't always possible).

(Pip has the problem that this still happens even if you use its "download" command — because it wants to verify that building the project would produce a package with a name and version that match what it says in the file name and/or other metadata, and because it wants to know what the dependencies are — and in the general case it's permitted to depend on the build process to tell you this, because the system for conditional-on-platform dependencies isn't powerful enough for everyone's use case. See also: https://zahlman.github.io/posts/2025/02/28/python-packaging-...)

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#266

Post by zahlman »

greatgib wrote: post #202

What is funny is again how many "young developers" had fun at old timers package managers like Debian being so slow to release new versions of packages. But never ever anyone was rooted because of malware that was snuck into an official .deb package. That was the concept of "stable" in the good old time, when software was really an "engineering" field.

> But never ever anyone was rooted because of malware that was snuck into an official .deb package.

Sure. The tradeoff is that when there's a zero-day, you have to wait for Debian to fix it, or to approve and integrate the dev's fix. Finding malware is one thing; finding unintentional vulns is another.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#267

Post by zahlman »

diggan wrote: post #85
herpdyderp wrote: post #59

Earlier quoted context omitted.

At least one thing is clear from this week: npm is too slow to respond.

> npm is too slow to respond Microsoft has been bravely saying "Security is top priority" since 2002 ( https://www.cnet.com/tech/tech-industry/gates-security-is-to... ) and every now and then reminds us that they put "security above all else" (latest in 2024: https://blogs.microsoft.com/blog/2024/05/03/prioritizing-sec... ), yet things like this persists. For how long time do Microsoft need to leave wide-open holes f…

TIL that NPM is a subsidiary of GitHub, making this indeed Microsoft's responsibility.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#268

Post by zahlman »

theanonymousone wrote: post #125

How do these things mostly happen for npm? Why not (much) PyPI or Maven? Or do they?

Python has a heavy standard library, and the most popular third-party libraries tend to have simple dependency graphs because they can lean on that standard library so much. Many of them are also maintained under umbrellas such as the Python Software Foundation (for things like `requests`) or the Python Packaging Authority (for build tools etc.). So there are many eyes on everything all the time, those eyes mostly belong to security-conscious people, and they all get to talk to each other quite a bit.

PyPI also now requires 2FA for everyone and makes other proactive attempts to hunt down malware (https://blog.pypi.org/posts/2023-05-25-securing-pypi-with-2f...) in addition to responding to reports.

There was still a known compromise recently: https://blog.pypi.org/posts/2025-07-31-incident-report-phish... (`num2words` gets millions of monthly downloads, but still for example two orders of magnitude less than NumPy). Speaking of the communication I mentioned in the first paragraph, one of the first people reporting seeing the phishing email was a CPython core developer.

Malware also still does get through regularly, in the form of people just uploading it. But there are automated measures against typo-squatting (you can't register a name that's too similar to existing names, or which is otherwise blacklisted) and for most random crap there's usually just no reason anyone would find out about it to install it.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#269

Post by eviks »

karel-3d wrote: post #258
eviks wrote: post #67

Earlier quoted context omitted.

What's the most common example of an alternative attack with autofill?

just recently there was a clickjacking attack that affected most popular password manager extensions. It tricked the managers into filling passwords to random pages, worked on almost all extensions and all pages.

Are you refering to this one https://marektoth.com/blog/dom-based-extension-clickjacking?

This doesn't seem to be "passwords on random pages", only "Personal Data + Credit Card,", passwords are domain-specific unless the website is hacked itself.

> The attacker can only steal credentials for the vulnerable domain.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#270

Post by eviks »

kaoD wrote: post #88
eviks wrote: post #67

Earlier quoted context omitted.

What's the most common example of an alternative attack with autofill?

The password manager's autofill browser extension gets compromised.

Common? Which of the good pw managers' extensions have been compromised in the last year?
Post reply on HN