Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud Returns: Over 300 NPM Packages Infected

helixguard.ai

Post reply on HN
Print view View original

271–280 of 797 posts

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#271

Post by skeeter2020 »

pasc1878 wrote: post #247
metaltyphoon wrote: post #225

Earlier quoted context omitted.

This is a reason why so many enterprises use C#. Most of the time you just use Microsoft made libraries and rarely brings in 3rd party.

Or purchase third party libraries. This does two things - limits what you drag in and also if you drag it in you can sue someone for errors.

This definitely not why enterprise "chooses" C# and neither of these were design decisions like implied. MS would have loved to have the explosive, viral ecosystem of Node earlier in .NET's life. Regardless a lot of companies using C# still use node-based solutions on the web so a insular development environment for one tier doesn't protect them.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#272

Post by jimbohn »

creata wrote: post #151
jimbohn wrote: post #146

Earlier quoted context omitted.

If I had to bet, the most likely and pragmatic solution will be to have dependencies cooldown and that's it

If everyone does it, then it becomes less effective, because there'd be fewer early testers to experience and report issues, no?

Yes, it's gonna be heuristics all way down. This problem isn't solved formally but the ecosystem(s) having these issues are too big to be discarded "just" because of that.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#273

Post by woodruffw »

junon wrote: post #192
progbits wrote: post #50

Earlier quoted context omitted.

Why do you keep using token auth? This is unacceptable negligence these days. NPM supports GitHub workflow OIDC and you can make that required, disabling all token access.

OIDC is not a silver bullet either and has its own set of vectors to consider too. If it works for your org model then great, but it doesn't solve every common scenario.

Trusted Publishing addresses the vector here, which is arbitrary persistence and delayed use of credentials by attackers. You're right that it's not a silver bullet (anything claiming to be one is almost certainly a financially induced lie), but it eliminates/foreshortens the attack staging window significantly.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#274

Post by exceptione »

querez wrote: post #216
exceptione wrote: post #209

My motto wrt language choices: "It's the standard lib, stupid!" My ultra hot take: there are only¹ two² programming ecosystems suitable for serious³ work: - .net (either run on CLR or compile as an AOT standalone binary) - jvm The reason why is because they have a vast and vetted std lib . A good standard lib is a bigger boost then any other syntactic niceties. __ 1. I don't want other programming languages to die, s…

Arguably both Go and Python also have great stdlibs. The only advantage that JVM and .NET have is a default GUI package. Which is fair, but keeps getting less and less relevant as people rely more on web UIs.

Respectfully disagree. Python and Go std lib do not even play in the same league. I had to help someone with datetime¹ handling in Python a while back. The stdlib is so poor, you have to reach out for a thirdparty lib for even the most basic of tasks².

Don't take my word for it, take a dive. You wouldn't be the first to have adjust their view.

For example, this section is just about the built-in web framework asp.net: https://learn.microsoft.com/en-us/aspnet/core

______

1. This might be a poor example as .net has NodaTime and the jvm has YodaTime as 3rd-party libs, for if one has really strict needs. Still, the builtin DateTime constructs offer way more than what Python had to offer.

2. Don't get me started on the ORM side of things. I know, you don't have to use one, but if you do, it better does a great job. And I wouldn't bat an eye if the ORM is not in the standard, but boy was I disappointed in Python's ecosystem. EF Core come batteries included and is so much better, it isn't fun anymore.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#275

Post by alextingle »

sph wrote: post #7
vintagedave wrote: post #2

Serious question: should someone develop new technologies using Node any more? A short time ago, I started a frontend in Astro for a SaaS startup I'm building with a friend. Astro is beautiful. But it's build on Node. And every time I update the versions of my dependencies I feel terrified I am bringing something into my server I don't know about. I just keep reading more and more stories about dangerous npm packages…

It's not "node" or "Javascript" the problem, it's this convenient packaging model. This is gonna ruffle some feathers, but it's only a matter of time until it'll happen on the Rust ecosystem which loves to depend on a billion subpackages, and it won't be fault of the language itself. The more I think about it, the more I believe that C, C++ or Odin's decision not to have a convenient package manager that fosters a ca…

Every time I look at a new project, my face falls when it's written in Rust. I simply don't trust a system that pulls in gigabytes of god-knows-what off the cloud, and compiles it on my box. It's a real barrier to entry, for me.

When I download a C project, I know that it only depends on my system libraries - which I trust because I trust my distro. Rust seems to expect me to take a leap in the dark, trusting hundreds of packagers and their developers. That might be fine if you're already familiar with the Rust ecosystem, but for someone who just wants to try out a new program - it's intimidating.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#276

Post by ashirviskas »

gspr wrote: post #174
jhancock wrote: post #161

Is there a terminal AI assistant that doesn't have heaps of depenedancies and preferably no node? Claude and codex both require node. I'm a fan of the lightweight octofriend. But also node. I do not like installing node on systems that otherwise would not require it.

llama.cpp?

Does it have a terminal assistant that I have not heard of? Otherwise, the parent asks about an assistant that is able to run various tools and stuff, not just talk.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#277

Post by latentsea »

metaltyphoon wrote: post #225
TheFlyingFish wrote: post #70

Earlier quoted context omitted.

I've worried about this for a while with Rust packages. The total size of a "big" Rust project's dependency graph is pretty similar to a lot of JS projects. E.g. Tauri, last I checked, introduces about 600 dependencies just on its own. Like another commenter said, I do think it's partially just because dependency management is so easy in Rust compared to e.g. C or C++, but I also suspect that it has to do with the si…

This is a reason why so many enterprises use C#. Most of the time you just use Microsoft made libraries and rarely brings in 3rd party.

Having worked on four different enterprise grade C# codebases, they most certainly have plenty of 3rd party dependencies. It would absolutely be the exception to not have 3rd party dependencies.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#278

Post by bilalq »

timgl wrote: post #4

co-founder of PostHog here. We were a victim of this attack. We had a bunch of packages published a couple of hours ago. The main packages/versions affected were: - posthog-node 4.18.1, 5.13.3 and 5.11.3 - posthog-js 1.297.3 - posthog-react-native 4.11.1 - posthog-docusaurus 2.0.6 We've rotated keys and passwords, unpublished all affected packages and have pushed new versions, so make sure you're on the latest versio…

You're probably already planning this, but please setup an alarm to fire off if a new package release is published that is not correlated with a CI/CD run.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#279

Post by skydhash »

inejge wrote: post #268
skydhash wrote: post #178

Earlier quoted context omitted.

Wait what? That’s just fearmongering, how hard is it to add a few methods that split a string or pad it? It’s not rocket science.

> how hard is it to add a few methods that split a string or pad it? In full generality, pretty hard. If you're just dealing with ASCII or Latin-1, no problem. Then add basic Unicode. Then combining characters. Then emojis. It won't be trivial anymore.

Full generality is not a practical target. You select your subset of the problem and you solve it. Supporting everything in a project is usually a fever dream.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#280

Post by delaminator »

testdelacc1 wrote: post #64
sph wrote: post #7

Earlier quoted context omitted.

It's not "node" or "Javascript" the problem, it's this convenient packaging model. This is gonna ruffle some feathers, but it's only a matter of time until it'll happen on the Rust ecosystem which loves to depend on a billion subpackages, and it won't be fault of the language itself. The more I think about it, the more I believe that C, C++ or Odin's decision not to have a convenient package manager that fosters a ca…

I hate to be the guy saying AI will solve it, but this is a case where AI can help. I think in the next couple of years we’ll see people writing small functions with Claude/codex/whatever instead of pulling in a dependency. We might or might not like the quality of software we see, but it will be more resistant to supply chain attacks.

For sure. I don't think the software ecosystem has come to terms with how things are going to change.

Libraries will be providing raw tools like - Sockets, Regex Engine, Cryptography, Syscalls, specific file format libraries

LLMs will be building the next layer.

I have build successful running projects now in Erlang, Scheme, Rust - I know the basic syntax of two of those but I couldn't write my deployed software in any of them in the couple of hours of prompting.

The scheme it had to do a lot of code from first principles and warned me how laborious it would be - "I don't care, you are doing it."

I have tools now I could not have imagined I could build in a reasonable time.

Post reply on HN