Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

github.com

Post reply on HN
Print view View original

271–280 of 296 posts

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#271

Post by cjonas »

neilv wrote: post #256
elric wrote: post #74

This is critical infrastructure, and it gets compromised way too often. There are so many horror stories of NPM (and similar) packages getting filled with malware. You can't rely on people not falling for phishing 100% of the time. People who publish software packages tend to be at least somewhat technical people. Can package publishing platforms PLEASE start SIGNING emails. Publish GPG keys (or whatever, I don't car…

> This is critical infrastructure, and it gets compromised way too often. Most times that I go to use some JS, Python, or (sometimes) Rust framework, I get a sinking feeling, as I see a huge list of dependencies scroll by. I know that it's a big pile of security vulnerabilities and supply-chain attack risk. Web development documentation that doesn't start with `npm install` seems rare now. Then there's the 'open sour…

What does having an "uneasy disapproving feeling" actually solve?

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#272

Post by karel-3d »

eviks wrote: post #269
karel-3d wrote: post #258

Earlier quoted context omitted.

just recently there was a clickjacking attack that affected most popular password manager extensions. It tricked the managers into filling passwords to random pages, worked on almost all extensions and all pages.

Are you refering to this one https://marektoth.com/blog/dom-based-extension-clickjacking ? This doesn't seem to be "passwords on random pages", only "Personal Data + Credit Card,", passwords are domain-specific unless the website is hacked itself. > The attacker can only steal credentials for the vulnerable domain.

ok that's nice

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#273

Post by Semaphor »

wavemode wrote: post #109
Semaphor wrote: post #77

Earlier quoted context omitted.

I use a hardware key as passkey where supported, nothing ties me to anything but those keys. Also there are OSS software managers that support them, like KeePass and friends.

does your hardware key work on mobile? or do you now need to maintain two keys for every service?

> does your hardware key work on mobile?

Yes, they support NFC

> or do you now need to maintain two keys for every service?

I maintain 4 keys so I have backups. In most cases registering additional keys is no problem, and this is only needed when signing up.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#274

Post by [deleted] »

0xbadcafebee wrote: post #126

At least third major compromise in two weeks. (last comment: https://news.ycombinator.com/item?id=45172225 ) (before that: https://news.ycombinator.com/item?id=45039764 ) Forget about phishing, it's a red herring. The actual solution to this is code signing and artifact signing. You keep a private key on your local machine. You sign your code and artifacts with it. You push them. The packages are verified by the end-…

[deleted]

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#275

Post by sunaookami »

Macha wrote: post #223
sunaookami wrote: post #211

Earlier quoted context omitted.

Nothing is plausible about this phishing mail - writing "update your password now" would be understandable but "update your 2FA now"? Never EVER seen this on any real site and it doesn't make sense (rotating passwords doesn't make sense either but not everyone got the memo).

I wonder how well this correlates with people for whom 2FA adoption was not a choice they made in the first place, but a thing that "NPM insists we do". For them, this email is not all that different from the emails that required them to set up 2FA in the first place.

I hope this is not true for those that made packages which are downloaded a million times per week.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#276

Post by cenamus »

SahAssar wrote: post #215
greatgib wrote: post #202

What is funny is again how many "young developers" had fun at old timers package managers like Debian being so slow to release new versions of packages. But never ever anyone was rooted because of malware that was snuck into an official .deb package. That was the concept of "stable" in the good old time, when software was really an "engineering" field.

> But never ever anyone was rooted because of malware that was snuck into an official .deb package. We got pretty close with the whole XZ thing. And people generated predictable keys due to a flaw in a debian patch to openssl. This stuff is hard and I'm not saying that npm is doing well but seems like no large ecosystem is doing exceptionally well either.

I'd say jus about every major linux dist is doing about 2 orders of magnitude better than npm

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#277

Post by jonplackett »

elric wrote: post #74

This is critical infrastructure, and it gets compromised way too often. There are so many horror stories of NPM (and similar) packages getting filled with malware. You can't rely on people not falling for phishing 100% of the time. People who publish software packages tend to be at least somewhat technical people. Can package publishing platforms PLEASE start SIGNING emails. Publish GPG keys (or whatever, I don't car…

One issue is that many institutions - banks, tech giants - still send ridiculously spammy looking emails asking you to click a link and go verify something.

All these actions are teaching people to be dumb and make it more likely they’ll fall for a scam because the pattern has been normal before.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#278

Post by eviks »

SAI_Peregrinus wrote: post #186
stanac wrote: post #64

Earlier quoted context omitted.

My password manager is a separate app, I always have to manually copy/paste the credentials. That's because I believed that approach to be more secure, now I see it's replacing one attack vector for another.

The one I use (KeePassXC) is also a separate app, but there are browser extensions for the major browsers to support autofill. Of course plenty of sites don't actually work with autofill, even the browser builtin autofill, because they don't mark the form fields properly. So autofill not working is common enough that it's not a reliable red flag. Separate password managers have the advantage that they can store passw…

> Of course plenty of sites don't actually work with autofill, even the browser builtin autofill, because they don't mark the form fields properly.

Can't KeePass use the autotype functionality, but still filter it by website domain/host that it gets from the extension? So basically you'll still never have to copy&paste, and any site requiring this would be a reliable red flag?

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#279

Post by neilv »

cjonas wrote: post #271
neilv wrote: post #256

Earlier quoted context omitted.

> This is critical infrastructure, and it gets compromised way too often. Most times that I go to use some JS, Python, or (sometimes) Rust framework, I get a sinking feeling, as I see a huge list of dependencies scroll by. I know that it's a big pile of security vulnerabilities and supply-chain attack risk. Web development documentation that doesn't start with `npm install` seems rare now. Then there's the 'open sour…

What does having an "uneasy disapproving feeling" actually solve?

The next sentence is one of the conclusions it might lead to.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#280

Post by diggan »

yawaramin wrote: post #239
diggan wrote: post #178

Earlier quoted context omitted.

As also mentioned elsewhere in this submission, it doesn't matter how often autofill breaks/works. There are two cases where it breaks: The accounts not showing up in the password manager modal, and the website autofill not working. The first is what prevents phishing, the second doesn't really matter to prevent phishing or not. The idea is that if your password manager doesn't show the usual list of accounts (regard…

Yes, the idea you are presenting is that the human being must manually check for mistakes. As should be clear by now, this idea does not work at scale. Passkeys will automate and enforce the check, removing human error from the equation.

> Yes, the idea you are presenting is that the human being must manually check for mistakes.

Not at all? The password manager handles that automatically, have you never used a password manager before?

> Passkeys will automate and enforce the check

What happens to the passkey when the origin changes, is it automatically recognising it as the new domain without any manual input? Curious to see what magic is responsible for that

Post reply on HN