Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

safedep.io

Post reply on HN
Print view View original

301–310 of 329 posts

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#301

Post by freakynit »

Hammershaft wrote: post #288
freakynit wrote: post #223

Earlier quoted context omitted.

Yep. 1. Every day there's a new package. 2. Then five more packages appear so you don't have to write that one terrifying line of JavaScript yourself. 3. Then someone writes a wrapper around those five packages. 4. Then someone writes a "modern, lightweight, zero-config" wrapper around the wrapper. 5. Then a framework adopts it, a build tool requires it, and suddenly your todo app has a dependency graph that looks li…

Pangram says this comment is %100 LLM generated. It certainly reads as LLM generated!

It was.. but not in the way people generally think. Im not a native english speaker. Therefore, I use chatgpt to fix my comment sometimes. This was done the same way.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#302

Post by matheusmoreira »

stephenr wrote: post #189
matheusmoreira wrote: post #58

Earlier quoted context omitted.

Every programming language package manager is affected. Any random person can sign up and push packages. They are all equivalent to the Arch Linux User Repository and have the exact same caveats.

How many other languages of any kind have a standard library that is so bizarrely lacking as JS? Now how many other mainstream languages of any kind have a standard library that is so lacking? Now how many other mainstream languages have a swathe of front-end developers that suddenly realised they can run code in a CLI or on a server, and spent exactly 0 minutes learning about how to make it not shit? Now how many ot…

This has nothing to do with standard libraries or popularity. It's about trust.

I signed up for an npm account and pushed packages. Same for PyPI. Same for Ruby gems.

There's no actual reason why anyone should believe I pushed anything but malware in there.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#303

Post by thrownthatway »

LtWorf wrote: post #269
thrownthatway wrote: post #199

Earlier quoted context omitted.

I’m not convinced. My understanding is that the problem is more that calling in the heavy artillery for what amounts to an annoyance, and maybe some financial harm, is generally considered impolite, even among nations that have conflicting worldviews.

You are allowed to have a conflicting world-view than USA as long as you have nukes, or, turns out, control a strait.

It’s one thing to have a conflicting world view.

It’s another thing to have the entire Iranian parliament broadcast chanting “death to America”.

I’m not even American.

I don’t even agree with half the stuff Trump says or does, but I’m onboard with at least 20% of it, and that’s infinitely better than the last bunch of clowns.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#304

Post by gus_ »

megous wrote: post #286
gus_ wrote: post #118

Earlier quoted context omitted.

Personally I don't allow outbound connections from almost any app, except web browsers to port 80/443. So nodejs, pip, ruby, curl, wget, etc, opening unexpected outbound connections is a big red flag for me. In some cases, maybe you need to allow permanently git to open outbound resquests to github.com (or gitlab, etc), but at least in my case, I'm okey allowing these connections manually. > preinstall script: bun ru…

1) write a well crafted exfil payload to mozilla or chrome directory (there are sqlite databases and files that store eg. indexeddb content) 2) trigger a tab open to attacker's website, website takes the exfil data from indexeddb and posts it to the server (have something inocuous looking on that website - like a fake npm homepage or whatever, so you don't close it fast enough) from one step process, this will become…

absolutely. These attacks will evolve for sure, like the malware evolved on Microslop for years.

But for the time being, the common entry vector is clear:

https://github.com/evilsocket/opensnitch/discussions/1119

> 2) trigger a tab open to attacker's website

be sure not to use extra cli parameters like "firefox --new-tab ", because if the rule is filtering by process path + cmdline it'll trigger a pop-up to allow the outbound request.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#305

Post by tardedmeme »

cess11 wrote: post #9
wlkr wrote: post #5

At this point I would very much like to get off Mr Bones' Wild Ride but I fear this is going to continue to happen because, from my own exploration at least, a large number of commercial detection strategies are directed at the repo/device/developer level when loading/using a package. This seems analogous to how we tackle email spam and general malware. It means that there is almost always a target valuable enough fo…

Wondering about Mr Bones' Wild Ride and suspecting it might be a reference to the 1991 movie Nothing But Trouble I took a look, and found I had remembered it wrong. The roller coaster in that movie was called Mr Bonestripper, https://www.youtube.com/watch?v=NEZEgd8GjJc . Instead it comes from Roller Coaster Tycoon 2, https://knowyourmeme.com/memes/mr-bones-wild-ride . As for the comparison with spam, there we kind of…

People who were born when this meme was current are 13 years old today. Time sucks. Time really sucks.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#306

Post by tardedmeme »

mghackerlady wrote: post #155
troad wrote: post #152

Earlier quoted context omitted.

I came from systems programming, so I think half of what happens in JS is nuts.

A lot of JS is nuts, but most of its basic behaviour that makes it not a good backend language make it an alright scripting language for the web specifically. I wish we would've used something tcl-y instead though, it's much cleaner and the "everything is a string"-ness makes sense for a fundamentally text based medium (the web)

If you drop-in replaced JS today with Lua, you'd have a conceptually similar language with a lot of warts chopped off. Backend devs can just cope with 1-based indexing though.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#307

Post by LtWorf »

thrownthatway wrote: post #303
LtWorf wrote: post #269

Earlier quoted context omitted.

You are allowed to have a conflicting world-view than USA as long as you have nukes, or, turns out, control a strait.

It’s one thing to have a conflicting world view. It’s another thing to have the entire Iranian parliament broadcast chanting “death to America”. I’m not even American. I don’t even agree with half the stuff Trump says or does, but I’m onboard with at least 20% of it, and that’s infinitely better than the last bunch of clowns.

If I were to bomb a school near you, you'd hold no grudge?

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#308

Post by zahlman »

btown wrote: post #233
zahlman wrote: post #193

Earlier quoted context omitted.

> and trust that NPM at least gets their "you can't republish to an old version" bare-minimum constraint right? ... Does NPM not create full lockfiles, with hashes and pinned transitive dependencies and everything?

Yes, and the problem here is that most projects have automated systems that automatically update those lockfiles on every upstream release of a library, under an assumption that minor releases are either security patches or bugfixes that would immediately be useful to the consuming project. IMO this is built on a pre-ShaiHulud, pre-AI set of assumptions, and should be evaluated from first principles with today's secu…

My point was the "with hashes" part. You aren't in fact "trusting" NPM to ensure that old versions aren't replaced if the package installer is verifying the hash.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#309

Post by stephenr »

matheusmoreira wrote: post #302
stephenr wrote: post #189

Earlier quoted context omitted.

How many other languages of any kind have a standard library that is so bizarrely lacking as JS? Now how many other mainstream languages of any kind have a standard library that is so lacking? Now how many other mainstream languages have a swathe of front-end developers that suddenly realised they can run code in a CLI or on a server, and spent exactly 0 minutes learning about how to make it not shit? Now how many ot…

This has nothing to do with standard libraries or popularity. It's about trust. I signed up for an npm account and pushed packages. Same for PyPI. Same for Ruby gems. There's no actual reason why anyone should believe I pushed anything but malware in there.

Did you not read point 3?

Developer experience level is a part of the problem.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#310

Post by matheusmoreira »

waz0wski wrote: post #76
matheusmoreira wrote: post #55

Earlier quoted context omitted.

Why not run a proper virtual machine?

That's the direction container runtimes are trending Amazon has been doing it with Firecracker for a while and Kata containers is another popular one https://github.com/firecracker-microvm/firecracker https://github.com/kata-containers/kata-containers

I did the same. Claude coded my own solution.

https://github.com/matheusmoreira/virtdev

It's been working really well. Use it every day. Just make some machines and ssh in.

Post reply on HN