Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM flooded with malicious packages downloaded more than 86k times

arstechnica.com

Post reply on HN
Print view View original

261–270 of 308 posts

Re: NPM flooded with malicious packages downloaded more than 86k times

#261

Post by contrahax »

This ultimately needs to get addressed at the OS level. Why is a random JS file on disk allowed to read my browser cookies without my awareness? Why is a native extension downloaded from S3? This goes across all package managers (npm, pypi, cargo).

I think security controls on macOS have been trending in the right direction to tackle these types of things comprehensively with secure domains, sandboxing, etc. but there is always a war of how much friction is too much when it comes to security.

We saw the same thing with 2SV where people were vehemently against it, and now many are clamoring that it should be the only way to be able to do things like publish packages (I agree! I have no issue jumping through some extra hoops when I publish something a million people will install).

This might be a hot take but I think a lot of loud mouths with their personal preferences have been holding security in this space back for a while, and recently people seem to be getting tired of it and pushing through. The engineering leadership that won't just make these types of high impact security decisions because it might irritate a handful of highly opinionated workflows is unfortunate!

Re: NPM flooded with malicious packages downloaded more than 86k times

#262

Post by ashishb »

larusso wrote: post #144
ashishb wrote: post #76

Earlier quoted context omitted.

> Also I can recommend pnpm, it has stopped executing lifecycle scripts by default so you can whitelist which ones to run. Imagine you are in a 50-person team that maintains 10 JavaScript projects, which one is easier? - Switch all projects to `pnpm`? That means switching CI, and deployment processes as well - Change the way *you* run `npm` on your machine and let your colleagues know to do the same I find the second…

I don’t get your argument here. 10 isn’t a huge number in my book but I don’t know of course what else that entails. I would opt for a secure process change over a soft local workflow restriction that may or may not be followed by all individuals. And I would definitely protect my CI system in the same way than local machines. Depending on the nature of CI these machines can have easy access rights. This really depen…

I'll do soft local workflow restriction right away.

The secure process change might take anywhere from a day to months.

Re: NPM flooded with malicious packages downloaded more than 86k times

#263

Post by ashishb »

joshkel wrote: post #260
azangru wrote: post #197

Earlier quoted context omitted.

> which one is easier? > Switch all projects to `pnpm`? Sorry; I am out of touch. Does pnpm not have these security problems? Do they only exist for npm?

pnpm doesn't execute lifecycle scripts by default, so it avoids the particular attack vector of "simply downloading and installing an NPM package allows it to execute malicious code." As phiresky points out, you're still "download[ing] arbitrary code you are going to execute immediately afterwards" (in many/most cases), so it's far from foolproof, but it's sufficient to stop many of the attacks seen in the wild. For…

Exactly so you should still execute all JS code in a container.

Re: NPM flooded with malicious packages downloaded more than 86k times

#264

Post by ashishb »

dns_snek wrote: post #195
ashishb wrote: post #58

Here's my `npm` command these days. It reduces the attack surface drastically. alias npm='docker run --rm -it -v ${PWD}:${PWD} --net=host --workdir=${PWD} node:25-bookworm-slim npm' - No access to my env vars - No access to anything outside my current directory (usually a JS project). - No access to my .bashrc or other files. Ref: https://ashishb.net/programming/run-tools-inside-docker/

This folk-wisdom scapegoating of post-install scripts needs to stop or people are going to get really hurt by the false sense of security it's creating. I can see the reasoning behind this, I really do, it sounds convincing but it's only half the story. If you want to protect your machine from malicious dependencies you must run everything in a sandbox all the time, not just during the installation phase. If you foll…

Exactly for JS code, run all inside the container, all the time.

I have been doing it for weeks now with no issues.

Re: NPM flooded with malicious packages downloaded more than 86k times

#265

Post by alt227 »

johnisgood wrote: post #259
alt227 wrote: post #236

Earlier quoted context omitted.

When you start writing with C, where do you get your stdio.h file? Do you write it yourself, or inspect it line by line every time or do you trust the installation package you just ran?

Your OS. glibc / musl.

Exactly, you are trusting an OS or library which could very much be maliciously interfered with.

I would be willing to bet attacks on linux upstream libraries are already happening in the same way as the js ecosystem.

Re: NPM flooded with malicious packages downloaded more than 86k times

#266

Post by alt227 »

klabb3 wrote: post #168
socalgal2 wrote: post #111

Earlier quoted context omitted.

It's no different anywhere else. I just downloaded jj (rust), it installed 470+ packages When I downloaded wan2gp (python) it installed it install 211 packages.

> It's no different anywhere else. But it is. Both C/C++ and Go are not at all like this. I don’t know about Python but Rust ecosystem tends attract enthusiasts who make good single purpose packages but that are abandoned because maintainers move on, or sometimes forked due to minor disagreements similar to how Linux/unix is fragmented with tribal feuds.

All languages use libraries that come from somewhere.

Even your OS upstream packages could be tainted at this point.

Re: NPM flooded with malicious packages downloaded more than 86k times

#267

Post by alt227 »

contrahax wrote: post #261

This ultimately needs to get addressed at the OS level. Why is a random JS file on disk allowed to read my browser cookies without my awareness? Why is a native extension downloaded from S3? This goes across all package managers (npm, pypi, cargo). I think security controls on macOS have been trending in the right direction to tackle these types of things comprehensively with secure domains, sandboxing, etc. but ther…

Whats to stop OS builds from being infiltrated either upstream or in build tooling?

Re: NPM flooded with malicious packages downloaded more than 86k times

#269

Post by alt227 »

jwr wrote: post #206

I always wondered why people found it acceptable to just run npm on their systems for anything they do, and have it download anything on any build. Coming from "make" with repeatable and predictable builds, I was appalled that you run this thing and you have no idea what it will download and what it will produce. Could be something different the next time you run it! Who knows! I also found it bizarre that even for t…

> freezing entire npm setups inside docker containers, which gave me reproducible builds

How does that work when enevitably those npm packages are shown to have vulnerabilites?

Re: NPM flooded with malicious packages downloaded more than 86k times

#270

Post by bandrami »

kolme wrote: post #201
bandrami wrote: post #87

Earlier quoted context omitted.

I get this but then in practice the only actually valuable stuff on my computer is... the code and data in my dev containers. Everything else I can download off the Internet for free at any time.

You don't have any stored passwords? Any private keys in your `.ssh/`? DB credentials in some config files? And the list goes on and on.

I don't store passwords (that always struck me as defeating the purpose) and my SSH keys are encrypted.
Post reply on HN