Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM flooded with malicious packages downloaded more than 86k times

arstechnica.com

Post reply on HN
Print view View original

291–300 of 308 posts

Re: NPM flooded with malicious packages downloaded more than 86k times

#291

Post by quails8mydog »

graemep wrote: post #225
Havoc wrote: post #220

Earlier quoted context omitted.

The entire Front end dev seems like trust me bro Wild West to me. All feels like endless layers of duct tape. Which I guess in a way it is given the evolution of browsers

it seems a lot worse with NPM for some reason, but the underlying weaknesses apply to language package managers in general too.

I think part of the reason is the embrace of an "each package should do exactly one thing" by many in the community, often taken to a ridiculous extreme. Possibly better now after left-pad and other similar incidents.

Re: NPM flooded with malicious packages downloaded more than 86k times

#292

Post by cutemonster »

zbentley wrote: post #283
cutemonster wrote: post #117

Earlier quoted context omitted.

It is a realistic solution.

Taking this more seriously than it perhaps deserves: if that’s true, why isn’t widespread adoption of this approach growing? Whether or not it’s a good idea, “realistic” implies practicality, which could presumably be measured by whether people find it worthwhile to do the thing.

I suppose it depends on what you're protecting, who's out there to get you, and how boring and time consuming it is to clean up after a breach (can't that take weeks or months), etc.

Aren't you're a bit asking "When X transportation method isn't used by everyone, can it really be any good?" :-)

Re: NPM flooded with malicious packages downloaded more than 86k times

#293

Post by mayhemducks »

Cybersecurity professionals are police officers and detectives first, technologists second. They are supposed to catch criminals who abuse technology. I find it distasteful to blame a tool and an entire community for things that criminals are responsible for.

There is nothing about Go, or Cargo, or Nuget, or any of the other systems that prevents criminals from committing crimes. Some cleverness can slow them down, or block certain roads to exploiting these systems, but managing risk in a supply chain is essential no matter which technology ecosystem is used.

Let's stop name-calling and throwing shade at specific tools and communities and get better at educating new-comers to the trade, and shaming and ostracizing the cyber-criminals who are causing the problems.

Re: NPM flooded with malicious packages downloaded more than 86k times

#294

Post by ozim »

mayhemducks wrote: post #293

Cybersecurity professionals are police officers and detectives first, technologists second. They are supposed to catch criminals who abuse technology. I find it distasteful to blame a tool and an entire community for things that criminals are responsible for. There is nothing about Go, or Cargo, or Nuget, or any of the other systems that prevents criminals from committing crimes. Some cleverness can slow them down, o…

Just this year Microsoft removed 300 NuGet packages by mistake as they were trying to automate defenses. They got pretty bad press after that so you will get bad comments one way or the other.

NPM ecosystem is very open it is not a bug it is a feature. There are of course issues from being open but NPM already has a lot of security features in place.

Re: NPM flooded with malicious packages downloaded more than 86k times

#295

Post by a022311 »

ashishb wrote: post #247
a022311 wrote: post #239

Earlier quoted context omitted.

Not sure how secure this really is, because it's fairly easy to break out of a Docker container with the default settings (due to the fact that the kernel is shared between containers and the host, unlike with VMs). Rootless Docker (or better, Podman) would improve security greatly.

Can you show an example of how can a malicious package break out of docker?

There have been quite a few exploits over the years, with the most recent public CVE 2 years ago [1].

Your specific setup uses `--net=host` and this opens you up to potential vulnerabilities (see [2]).

You also shouldn't forget that containers have unrestricted network access bu default anyway. Even if your device is safe, they may be able to infect other vulnerable devices on your network.

[1]: https://docs.docker.com/security/security-announcements/#doc... [2]: https://github.com/0xn3va/cheat-sheets/blob/main/Container/E...

Re: NPM flooded with malicious packages downloaded more than 86k times

#296

Post by int_19h »

bytefish wrote: post #212
Sander_Marechal wrote: post #210

Earlier quoted context omitted.

How does Deno solve this? Genuine question by the way. I'm not trying to be snarky.

It provides a runtime, that sandboxes your application and requires you to give explicit permissions for file system operations and network requests. This limits the attack surface, when it comes to installing malicious dependencies, that npm happily installs for you. So yes, I was wrong and my previous comment a hyperbole. A big problem is npm, and not JavaScript. My point about the staggering amount of dependencies…

Of course, this only works so long as the sandbox is secure.

There have been attempts to do this kind of sandboxing before. Java and .NET both used to have it. Both dropped it because it turns out that properly sandboxing stuff is hard.

Re: NPM flooded with malicious packages downloaded more than 86k times

#297

Post by int_19h »

cogman10 wrote: post #277
procaryote wrote: post #180

Earlier quoted context omitted.

There's a culture of micro-dependencies. In c++, most people wouldn't publish a library that does the equivalent of (1 == value % 2). Even if they did, almost no one would use it. For npm, that library will not only exist, it will have several dependencies and millions of downloads

That increases the surface area, which is certainly bad. But that doesn't really mean the risk isn't similarly there for C++. A few years back, the university of Minnesota was banned from the kernel (are they still banned?) for testing this exact theory. They tried to figure out how hard it would be to inject an intentional CVE into the kernel. [1] https://www.bleepingcomputer.com/news/security/linux-bans-un...

In practice this means that in C and C++ land you have large framework-style libraries (GLib, Boost, Qt etc), which are much easier to vet, and doing it ones gives you a whole lot of goodies at once with minimal dependencies.

Re: NPM flooded with malicious packages downloaded more than 86k times

#298

Post by ashishb »

Intralexical wrote: post #286
ashishb wrote: post #58

Here's my `npm` command these days. It reduces the attack surface drastically. alias npm='docker run --rm -it -v ${PWD}:${PWD} --net=host --workdir=${PWD} node:25-bookworm-slim npm' - No access to my env vars - No access to anything outside my current directory (usually a JS project). - No access to my .bashrc or other files. Ref: https://ashishb.net/programming/run-tools-inside-docker/

You should probably put some quotes around `$PWD`: alias npm='docker run --rm -it -v "$PWD:$PWD" --net=host --workdir="$PWD" node:25-bookworm-slim npm' ...Does this always work? I don't use much JS. Doesn't NPM sometimes build against system libs, which could be different in the container?

> You should probably put some quotes around `$PWD`:

Yeah, fair point.

> Doesn't NPM sometimes build against system libs, which could be different in the container?

Yes, and I run all JS inside a container.

Re: NPM flooded with malicious packages downloaded more than 86k times

#299

Post by a96 »

styanax wrote: post #208
crtasm wrote: post #4

>When you run npm install, npm doesn't just download packages. It executes code. Specifically, it runs lifecycle scripts defined in package.json - preinstall, install, and postinstall hooks. What's the legitimate use case for a package install being allowed to run arbitrary commands on your computer? Quote is from the researchers report https://www.koi.ai/blog/phantomraven-npm-malware-hidden-in-i... edit: I was think…

> What's the legitimate use case for a package install being allowed to run arbitrary commands on your computer? The paradigm itself has been in package managers since DEB and RPM were invented (maybe even Solaris packages before that? it's been a minute since I've Sun'd); it's not the same as NPM, a more direct comparison is the Arch Linux AUR - and the AUR has been attacked to try and inject malware all year (2025)…

There's a huge difference between running a script inside an audited package from a curated source and the curl | sh installers.

Re: NPM flooded with malicious packages downloaded more than 86k times

#300

Post by a96 »

squidsoup wrote: post #14
ajross wrote: post #11

Earlier quoted context omitted.

> As a hobbyist how do I stay protected and in the loop for breaches like this? For the case of general software, "Don't use node" would be my advice, and by extension any packaging backend without external audit and validation. PyPI has its oopses too, Cargo is theoretically just as bad but in practice has been safe. The gold standard is Use The Software Debian Ships (Fedora is great too, arch is a bit down the ladd…

Having spent a year trying to develop against dependencies only provided by a debian release, it is really painful in practice. At some point you're going to need something that is not packaged, or newer than the packaged version in your release.

I've spent thirty, mostly on stable, and there's been minimal pain. Several orders of magnitude less than on any other system.

(That might hint that I'm not doing trendy things.)

Post reply on HN