Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

safedep.io

Post reply on HN
Print view View original

31–40 of 329 posts

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#32

Post by [deleted] »

fnoef wrote: post #23
mentalgear wrote: post #16

Earlier quoted context omitted.

For credential stealing, that is true, but at least it would protect your local machine. But I just read these worms also try container escape ...

You need to use full isolated VM with its own kernel. But then again, I've read somewhere that this malware is also trying to escape the VM isolation as well...

[deleted]

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#33

Post by vsgherzi »

mentalgear wrote: post #13

> Docker Container Escape > The payload checks for the Docker socket and, if present, attempts container escape through three sequential methods: So even if you're running devcontainers / VMs, these worms are already trying to escape. Make sure you're running a rootless VM engine (e.g. podman instead of docker) !

I really wish we would’ve gotten something more like jails or zones. Or better yet put the containers in a jail or zone. Is there a comprehensive sandbox for Linux like the bsds have?

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#34

Post by abhisek »

somelamer567 wrote: post #28

In the fictional universe of William Gibson's Sprawl trilogy, it is legal and normal for defenders to go kinetic on cyberattackers. How long until it is simply easier for governments and big business in the countries victimised by these criminal groups, to find the path of least resistance and go after them personally?

Attackers are just having fun due to abysmal state of npm and some of the insecure design choices by GitHub and GitHub Actions. Every attack gives them credentials which in turn used to stage more attacks.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#35

Post by thrownthatway »

fnoef wrote: post #10
exiguus wrote: post #7

Earlier quoted context omitted.

I also was at this point, and I decided to add cooldowns to every project.

Yeah, I agree, but then you are at the mercy of whatever vulnerability is found in the current version(s). It just feels like a lose-lose situation no matter what you do.

So long as we insist on everything from a light switch, the vacuum cleaner, security camera, clothes dryer, TV, car, and mobile phone being an always on, always online, Universal Turing Machine we’re not going to find a solution.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#37

Post by darkwi11ow »

fnoef wrote: post #4

I’m honestly at a point where I’m afraid to update any of my project’s dependencies, and I’m also afraid to run the locally without some locked down VM

I use Tanstack in my projects. Last week when Tanstack got compromised, it was only my laziness that saved me -- was thinking about doing pnpm upgrade but got lazy and played some dota... Finished game was just going to pnpm upgrade, opened hacker news and boom! news hit.

Since then, I had set up libvirt/qemu based VM with another Linux running in it specifically for development. Now I run all of docker, kubernetes, IDE, pnpm, uv, etc in that VM and removed them from host. The only write capable secret VM has access to, is my passphrase protected ssh key, which I can quickly revoke from my Github account in case of compromise. Feels much safer now.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#38

Post by cyanydeez »

mentalgear wrote: post #13

> Docker Container Escape > The payload checks for the Docker socket and, if present, attempts container escape through three sequential methods: So even if you're running devcontainers / VMs, these worms are already trying to escape. Make sure you're running a rootless VM engine (e.g. podman instead of docker) !

i wish opencode would have a protocol that puts real guardrails around its agents. rather that gaving to try and transplant weve had ssh for decades, surely you can wire a xomms pathway that cant deciate.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#39

Post by AgentME »

Another supply chain attack found and blocked in a day. Everyone regularly using npm to install new packages should be using npm's min-release-age setting to avoid package versions that are newer than a few days old to avoid most attacks in practice like this. You can set it to two days with `npm config set min-release-age=2` for example. https://cooldowns.dev/ has info about equivalent settings in other dependency managers like PyPI and Cargo.
Post reply on HN