Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

safedep.io

Post reply on HN
Print view View original

321–329 of 329 posts

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#321

Post by stephenr »

matheusmoreira wrote: post #314
stephenr wrote: post #312

Earlier quoted context omitted.

> It's only natural to use the stuff that is out there Sure, if your entire "community" lives and dies by a nonsensical "don't reinvent the wheel, there is a package for that " chant that would rival the most fervent cult members.

That is quite literally the most persistent cargo cult in the entire computing industry. It's the rule, not the exception. Pretty much every community is guilty of it.

Which other community imports a third party package rather than writing `% 2 === 0` (or it's equivalent) code to test if a number is even or not?

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#323

Post by LtWorf »

thrownthatway wrote: post #319
LtWorf wrote: post #307

Earlier quoted context omitted.

If I were to bomb a school near you, you'd hold no grudge?

Come now. If that school was being used as cover for a military operation by Islamic extremist who recently shot up a music festival I was at, capturing some of the females and raping them then shooting out their eyes and vaginas. Enough of the false equivocation. My coffee was a little two hot this morning FUCKING JEWS!

Israel is the country where most journalists get killed. But sure, mass killing is completely equivalent to bad coffee.

You people disgust me.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#324

Post by jdxcode »

no-name-here wrote: post #297
rubnogueira wrote: post #40

aube (npm/yarn/pnpm drop-in alternative) now has a "jailBuilds" flag that restricts access to network/filesystem access. https://aube.en.dev/package-manager/jailed-builds.html But this feels like a cat/mouse game.

> aube (npm/yarn/pnpm drop-in alternative) now has a "jailBuilds" flag that restricts access to network/filesystem access. 1. It seems like the restrictions are only for lifecycle scripts, so wouldn't help if/when the package's actual code had malicious code inserted? 2. Package managers like pnpm seem to entirely block lifecycle scripts by default, so I guess this is an in-between solution. Still, I guess it's a ste…

1. the supply chain attacks I've seen are naive. They just leverage postinstall hooks. Malicious code also needs to be executed, not simply installed, so it's a lot less likely that an exploit would happen compared to postinstall since it can't just be buried in a transitive.

2. aube does the same. This is an extra level of protection if you've already whitelisted a package

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#325

Post by troad »

okanat wrote: post #208
mghackerlady wrote: post #198

Earlier quoted context omitted.

And before PHP it was Visual Basic, and COBOL even further back. I'm convinced trying to teach people to program without them understanding the basics of how computers work will lead to this.

It is not about not teaching them, I am co-graduated with many people who do YOLO JS and AI slop right now. They had to pass the same architecture and microprocessor programming lectures. Educated or not, there are many programmers who simply don't give a fuck. Unless you make all the IT jobs a regulated profession and enforce significant yearly recertification, the mediocres will dominate. You cannot be nice and inc…

> Unless you make all the IT jobs a regulated profession and enforce significant yearly recertification, the mediocres will dominate.

This would merely optimise the industry for people who are good at wiggling through bureaucratic hurdles. It would entrench mediocrity while lopping off the extreme ends of the skill distribution - on both ends.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#326

Post by thrownthatway »

LtWorf wrote: post #323
thrownthatway wrote: post #319

Earlier quoted context omitted.

Come now. If that school was being used as cover for a military operation by Islamic extremist who recently shot up a music festival I was at, capturing some of the females and raping them then shooting out their eyes and vaginas. Enough of the false equivocation. My coffee was a little two hot this morning FUCKING JEWS!

Israel is the country where most journalists get killed. But sure, mass killing is completely equivalent to bad coffee. You people disgust me.

It’s also the most culturally diverse country in the region.

Israel has a Muslim judge in their Supreme Court.

Are there any Muslim majority countries in the region with a Jewish Supreme Court justice?

https://en.wikipedia.org/wiki/Khaled_Kabub

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#327

Post by sitkack »

thrownthatway wrote: post #295
sitkack wrote: post #287

Earlier quoted context omitted.

wtf does shop lifting have to do with the conversation and why would it take priority vs anything else ? how is that an argument don't attack people like this on this forum or you will get banned

We can’t even prevent shoplifting, what expectation should there be that we’d be capable of mounting any sort of offence / defence against malware outfits. I dunno, some people just have no sense of humour. > or you will get banned Oh yeah, run and tell the teacher. Dibberdobber. Tell me, did you grow up in a fatherless home?

Dibberdobber, I was with you up until you trotted this one out. Civility is dead on the internet, and you need to get your burns from someone other than Ned Flanders.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#328

Post by kixxauth »

no-name-here wrote: post #70
kixxauth wrote: post #67

Vendor your dependencies, clone or port them where needed, and freeze them. Most good packages these days do not have a deep dependency tree, and we should stop using the ones that do. I spent a week with claude and codex re-implementing several packages which had dependency trees deeper than I would like. Most of these packages are trivial to clone. "But now you're not getting the upstream fixes" they will say. "So…

Wouldn't just having devs pin/not upgrade packages accomplish about as much, have the added benefit that if a package is discovered malicious it would be removed from npm but if already vendored you’d still have the vulnerability on your vendored copy, and pinning versions seems like it would be more likely for devs to do than vendoring?

Yeah, pinning dependencies is very similar to vendoring or cloning them. By cloning, you get to know the code better and how it is structured, plus you cherry pick only the features you want.

But, like you said, you are at risk of introducing new vulnerabilities.

I'd just prefer making that bet on myself than someone I don't know

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#329

Post by dbacar »

pennomi wrote: post #147
jeswin wrote: post #72

Earlier quoted context omitted.

Installing docker doesn't require root. "Rootless mode lets you run the Docker daemon and containers as a non-root user." https://docs.docker.com/engine/security/rootless/ This is how docker is best installed on Linux, and there's a convenience script for it as well ( https://get.docker.com/rootless ). I am surprised that's not how people are using docker.

If it’s not default, most people won’t do it.

Most poeople even dont know about it.
Post reply on HN