Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM flooded with malicious packages downloaded more than 86k times

arstechnica.com

Post reply on HN
Print view View original

271–280 of 308 posts

Re: NPM flooded with malicious packages downloaded more than 86k times

#271

Post by bandrami »

jamesnorden wrote: post #214
bandrami wrote: post #87

Earlier quoted context omitted.

I get this but then in practice the only actually valuable stuff on my computer is... the code and data in my dev containers. Everything else I can download off the Internet for free at any time.

This kind of mentality, and "seems a bit excessive to sandbox a command that really just downloads arbitrary code", is why the JS ecosystem is so prone to credential theft. It's actually insane to read stuff like that said out loud.

Right but the opposite mentality winds up putting so much of the eggs in the basket of the container that it defeats a lot of the purpose of the container.

Re: NPM flooded with malicious packages downloaded more than 86k times

#272

Post by johnisgood »

alt227 wrote: post #265
johnisgood wrote: post #259

Earlier quoted context omitted.

Your OS. glibc / musl.

Exactly, you are trusting an OS or library which could very much be maliciously interfered with. I would be willing to bet attacks on linux upstream libraries are already happening in the same way as the js ecosystem.

What makes you think that this is the case?

And yeah I'm trusting my OS (Linux) and the libraries that is in their repository.

We could go deeper than that. What about hardware? None of it is open source.

Where does it end? What can we do about it?

Re: NPM flooded with malicious packages downloaded more than 86k times

#273

Post by brabel »

alt227 wrote: post #265
johnisgood wrote: post #259

Earlier quoted context omitted.

Your OS. glibc / musl.

Exactly, you are trusting an OS or library which could very much be maliciously interfered with. I would be willing to bet attacks on linux upstream libraries are already happening in the same way as the js ecosystem.

Hm... if you use something like Debian it's quite difficult to get your package installed in the distro. People do review everything that goes in. I find it incredibly silly to compare something like that to npm, where every kid has dozens of packages installed that anyone using npm can end up downloading and no one is really reviewing anything.

Re: NPM flooded with malicious packages downloaded more than 86k times

#274

Post by contrahax »

alt227 wrote: post #267
contrahax wrote: post #261

This ultimately needs to get addressed at the OS level. Why is a random JS file on disk allowed to read my browser cookies without my awareness? Why is a native extension downloaded from S3? This goes across all package managers (npm, pypi, cargo). I think security controls on macOS have been trending in the right direction to tackle these types of things comprehensively with secure domains, sandboxing, etc. but ther…

Whats to stop OS builds from being infiltrated either upstream or in build tooling?

Really good internal security practices by the people who make the OS :) I don't think an attacker would be able to pull off disabling features like secure domains, secure enclave, etc. in macOS without anyone noticing seeing as it takes months of approvals, testing, etc. for a single build to even hit the beta channel.

Re: NPM flooded with malicious packages downloaded more than 86k times

#275

Post by alt227 »

johnisgood wrote: post #272
alt227 wrote: post #265

Earlier quoted context omitted.

Exactly, you are trusting an OS or library which could very much be maliciously interfered with. I would be willing to bet attacks on linux upstream libraries are already happening in the same way as the js ecosystem.

What makes you think that this is the case? And yeah I'm trusting my OS (Linux) and the libraries that is in their repository. We could go deeper than that. What about hardware? None of it is open source. Where does it end? What can we do about it?

This is why Huwawei equipment was disallowed to be part of Western Europes 5g rollout.

https://www.euronews.com/next/2024/08/12/eleven-eu-countries...

What can we do about it indeed!? I guess its either fully digitally detox or accept the fact that if you use modern technology then somebody is watyching what you do.

Re: NPM flooded with malicious packages downloaded more than 86k times

#276

Post by alt227 »

brabel wrote: post #273
alt227 wrote: post #265

Earlier quoted context omitted.

Exactly, you are trusting an OS or library which could very much be maliciously interfered with. I would be willing to bet attacks on linux upstream libraries are already happening in the same way as the js ecosystem.

Hm... if you use something like Debian it's quite difficult to get your package installed in the distro. People do review everything that goes in. I find it incredibly silly to compare something like that to npm, where every kid has dozens of packages installed that anyone using npm can end up downloading and no one is really reviewing anything.

I agree one is more difficult than the other, but I feel the principal is the same. Whilst anything is built using other modules, there is always risk those modules will be compromised.

Re: NPM flooded with malicious packages downloaded more than 86k times

#277

Post by cogman10 »

procaryote wrote: post #180
cogman10 wrote: post #81

Earlier quoted context omitted.

There's nothing really specially about the JS ecosystem that creates this problem. Plenty of others could fall in the same way, including C++ (see xz). The problem is we've been coasting on an era where blind trust was good enough an programming was niche enough.

There's a culture of micro-dependencies. In c++, most people wouldn't publish a library that does the equivalent of (1 == value % 2). Even if they did, almost no one would use it. For npm, that library will not only exist, it will have several dependencies and millions of downloads

That increases the surface area, which is certainly bad. But that doesn't really mean the risk isn't similarly there for C++.

A few years back, the university of Minnesota was banned from the kernel (are they still banned?) for testing this exact theory. They tried to figure out how hard it would be to inject an intentional CVE into the kernel.

[1] https://www.bleepingcomputer.com/news/security/linux-bans-un...

Re: NPM flooded with malicious packages downloaded more than 86k times

#278

Post by ashishb »

tetha wrote: post #182
phiresky wrote: post #68

Earlier quoted context omitted.

That seems a bit excessive to sandbox a command that really just downloads arbitrary code you are going to execute immediately afterwards anyways? Also I can recommend pnpm, it has stopped executing lifecycle scripts by default so you can whitelist which ones to run.

At work, we're currently looking into firejail and bubblewrap a lot though and within the ops-team, we're looking at ways to run as much as possible, if not everything through these tools tbh. Because the counter-question could be: Why would anything but ssh or ansible need access to my ssh keys? Why would anything but firefox need access to the local firefox profiles? All of those can be mapped out with mount namesp…

firejail, bubblewrap, direct chroot, sandbox-run ... all have been mentioned in this thread.

There is a gazillion list of tools that can give someone analysis paralysis. Here's my simple suggestion: all of your backend team already knows (or should) learn Docker for production deployments.

So, why not rely on the same? It might not be the most efficient, but then dev machines are mostly underutilized anyway.

Re: NPM flooded with malicious packages downloaded more than 86k times

#279

Post by johnisgood »

azangru wrote: post #199
ab_testing wrote: post #108

Given the recent npm attacks, is it even safe to develop using npm. Whenever I start a react project, it downloads hundreds of additional packages which I have mo idea about what they do. As a developer who has learnt programming as a hobby, is it better to stick to some other safe ways to develop front end like thyme leaf or plain js or something else. When I build backend in flask or Django, I specifically type the…

> As a developer who has learnt programming as a hobby, is it better to stick to some other safe ways to develop front end like thyme leaf or plain js or something else. Oh, absolutely, there is no question about it. Fewer dependencies means less headache; and if you can get the number of your dependencies to zero, then you have won the internet.

Sounds like... C.

Re: NPM flooded with malicious packages downloaded more than 86k times

#280

Post by ashishb »

alt227 wrote: post #234
ashishb wrote: post #76

Earlier quoted context omitted.

> Also I can recommend pnpm, it has stopped executing lifecycle scripts by default so you can whitelist which ones to run. Imagine you are in a 50-person team that maintains 10 JavaScript projects, which one is easier? - Switch all projects to `pnpm`? That means switching CI, and deployment processes as well - Change the way *you* run `npm` on your machine and let your colleagues know to do the same I find the second…

Yeah, id just take the time to convert the 10 projects rather than try to get 50 people to chnage their working habots, plus new staff coming in etc. Switch your projects once, done for all.

So, switching to pnpm does not entail any work habit changes?
Post reply on HN