Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

safedep.io

Post reply on HN
Print view View original

281–290 of 329 posts

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#281

Post by gabdpipi »

OhMeadhbh wrote: post #276
gabdpipi wrote: post #275

Earlier quoted context omitted.

It’s not just cryptography when a developers password manager gets compromised and all, the hacker is “in”. If it’s secured by a hardware key, they need to have the key physically. Two step could work as well with the proper Authenticator.

IPCMSes make it somewhat easy to MitM SMS. If your system poops a cookie in the wrong place it doesn't matter if the secret is in someone's head or if it's in a hardware dongle, like you say... the hacker is "in". My recommendation for bad guys is to not attack the part of the system where it is strong. Just sniff around a bit until you find the weak part and attack that. Also remember most devs couldn't use a static…

Yeah that’s fair. It’s only as secure as the weakest link.

That was one of the promises of wasm was sandboxing npm packages independently. Not sure what happened with that or not but I’d be curious to know now we’ve had a lot of recent supply-chain publicity.

For example, if every fetched module is sandboxed and even if they got compromised there would be more protection. It would be more “when” not “if” the package is compromised, nip it in the bud.

But then attackers will target the most exposed packages… :)

Security is hard.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#282

Post by megous »

kommunicate wrote: post #225
bakugo wrote: post #219

Earlier quoted context omitted.

Is there anything about npm that makes it particularly susceptible to these attacks, other than the fact that it's the most popular package manager of all?

npm can execute code after install and most package managers don't do that

You're installing code from npm anyway, presumably to execute it at some point on some machine. If it's will be executed from an install script or later during app execution should not really make much of a difference for most devs.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#284

Post by josephg »

tomxor wrote: post #230

At this point lifecycle script should be disabled by default in NPM. It's a convenience feature that provides built-in Arbitrary Code Execution (even for transient dependencies), and every one of these widespread NPM worm style attacks has propagated through it, because of the default setting. Also enabling it for one command shouldn't automatically permit all transient dependencies to run lifecycle scripts, it shoul…

Yeah. Or they should run in a sandbox. I would have no problem with a post install script which ran arbitrary commands in the context of the installed package itself. But arbitrary scripts + user level permissions is a recipe for disaster.

That said, packages could still just run whatever junk they want when they first get imported in a program.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#285

Post by esafak »

cyanydeez wrote: post #44
rubnogueira wrote: post #40

aube (npm/yarn/pnpm drop-in alternative) now has a "jailBuilds" flag that restricts access to network/filesystem access. https://aube.en.dev/package-manager/jailed-builds.html But this feels like a cat/mouse game.

dino was wired with security in mind, but you can see developers dont tend towards aecurity

What is dino?

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#286

Post by megous »

gus_ wrote: post #118
pingou wrote: post #82

Earlier quoted context omitted.

That wouldn't help in that case as exfiltrated data is committed to public GitHub repositories. Unless you have to accept every time an app posts or requests data from known hosts?

Personally I don't allow outbound connections from almost any app, except web browsers to port 80/443. So nodejs, pip, ruby, curl, wget, etc, opening unexpected outbound connections is a big red flag for me. In some cases, maybe you need to allow permanently git to open outbound resquests to github.com (or gitlab, etc), but at least in my case, I'm okey allowing these connections manually. > preinstall script: bun ru…

1) write a well crafted exfil payload to mozilla or chrome directory (there are sqlite databases and files that store eg. indexeddb content) 2) trigger a tab open to attacker's website, website takes the exfil data from indexeddb and posts it to the server (have something inocuous looking on that website - like a fake npm homepage or whatever, so you don't close it fast enough)

from one step process, this will become universally usable two step process

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#287

Post by sitkack »

thrownthatway wrote: post #190
sitkack wrote: post #99

Earlier quoted context omitted.

Compared to what?

Are you ok? Compared to calling in air support on cyber criminals. How’s your reading comprehension coming along?

wtf does shop lifting have to do with the conversation and why would it take priority vs anything else ? how is that an argument

don't attack people like this on this forum or you will get banned

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#288

Post by Hammershaft »

freakynit wrote: post #223
bakugo wrote: post #219

Earlier quoted context omitted.

Is there anything about npm that makes it particularly susceptible to these attacks, other than the fact that it's the most popular package manager of all?

Yep. 1. Every day there's a new package. 2. Then five more packages appear so you don't have to write that one terrifying line of JavaScript yourself. 3. Then someone writes a wrapper around those five packages. 4. Then someone writes a "modern, lightweight, zero-config" wrapper around the wrapper. 5. Then a framework adopts it, a build tool requires it, and suddenly your todo app has a dependency graph that looks li…

Pangram says this comment is %100 LLM generated.

It certainly reads as LLM generated!

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#289

Post by pyinstallwoes »

Terr_ wrote: post #258
zahlman wrote: post #200

Earlier quoted context omitted.

> the models will be good enough in social engineering Never mind questions of how good the models will/can get. I'm confused why people expect that, in principle , models getting really good at social engineering would have such huge impact. Seems to me like it has diminishing returns and is severely bottlenecked by the fact that the target operates at human speed. The amount of effort involved in the XZ hack, for e…

I'm imagining an influence campaign where someone weaponizes targeted advertising and recommendation engines against Mr. Trusted Maintainer, so that it's a The Truman Show effect, where the background of their entire digital bubble pushing the idea that they need retire and delegate.

This definitely happens. Perhaps more on a state actor level of sophistication but yeah. I’ve seen it. It’s wild.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#290

Post by pyinstallwoes »

ErroneousBosh wrote: post #195
Icathian wrote: post #136

Earlier quoted context omitted.

Yeah, I'm reminded of 15 years ago being told Linux was super secure because people were popping Windows all the time. Turns out it was mostly just a function of effort pointed at the target, and I don't have any reason to believe that's not the case here too.

Linux has had 100% market penetration for 20 years or so now. Everyone using a computer uses Linux *somewhere* in it. You'd think if it was that easy, there would be exploits all over the place. Why isn't every single desk phone and router part of a botnet?

I mean? Many of them are…
Post reply on HN