Malicious versions of Nx and some supporting plugins were published

Post by VPenkov » Wed, Aug 27, 2025, 8:59 PM UTC

andix wrote: post #283

Are there any package managers that have something like a min-age setting. To ignore all packages that were published less than 24 or 36 hours ago? I’ve run into similar issues before, some package update that broke everything, only to get pulled/patched a few hours later.

Post by ZeWaka » Wed, Aug 27, 2025, 8:59 PM UTC

VPenkov wrote: post #321

andix wrote: post #283

Are there any package managers that have something like a min-age setting. To ignore all packages that were published less than 24 or 36 hours ago? I’ve run into similar issues before, some package update that broke everything, only to get pulled/patched a few hours later.

Not a package manager, but Renovate bot has a setting like that (minimumReleaseAge). Dependabot does not (Edit: does now). So while your package manager will install whatever is newest, there are free solutions to keep your dependencies up to date in a reasonable manner. Also, the javascript ecosystem seems to slowly be going in the direction of consolidation, and supply chain attacks are (again, slowly) getting tool…

Post by rcxdude » Wed, Aug 27, 2025, 9:02 PM UTC

christophilus wrote: post #246

hvb2 wrote: post #99

Earlier quoted context omitted.

Is that realistic though? What you're proposing is letting go of abstractions completely. Say you need compression, you're going to review changes in the compression code? What about encryption, a networking library, what about the language you're using itself? That means you need to be an expert on everything you run. Which means no one will be building anything non trivial.

Yes. I would review any changes to any 3rd party libraries. Why is that unrealistic? Regarding the language itself, I may or may not. Generally, I pick languages that I trust. E.g. I don't trust Google, but I don't think the Go team would intentionally place malware in the core tools. Libraries, however, often are written by random strangers on the internet with a different level of trust.

Post by thayne » Wed, Aug 27, 2025, 9:07 PM UTC

TheDong wrote: post #164

pharrington wrote: post #151

Earlier quoted context omitted.

You're confusing compile-time with build-time. And build time code execution exists absolutely exists in go, because that's what a build tool is. https://pkg.go.dev/cmd/go#hdr-Add_dependencies_to_current_mo...

I think you're misunderstanding. "go build" of arbitrary attacker controlled go code will not lead to arbitrary code execution. If you do "git clone attacker-repo && cargo build", that executes "build.rs" which can exec any command. If you do "git clone attacker-repo && go build", that will not execute any attacker controlled commands, and if it does it'll get a CVE. You can see this by the following CVEs: https://pk…

Post by eightys3v3n » Wed, Aug 27, 2025, 9:10 PM UTC

skydhash wrote: post #117

eightys3v3n wrote: post #73

Earlier quoted context omitted.

I would argue the distinction between my own user and root is not meaningful when they say "all files by default". As my own user, it can still access everything I can on a daily basis which is likely everything of importance. Sure it can't replace the sudo binary or something like that, but it doesn't matter because it's already too late. Why when I download and run Firefox can it access every file my user can acces…

Because it will become unpractical. It’s like saying your SO shouldn’t have access to your bedroom, or the maid should only have access to a single room. Instead what you do is having trusted people and put everything important in a safe. In my case, I either use apt (pipx for yt-dlp), or use a VM.