Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud Returns: Over 300 NPM Packages Infected

helixguard.ai

Post reply on HN
Print view View original

331–340 of 797 posts

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#331

Post by zwnow »

root_axis wrote: post #290
zwnow wrote: post #164

Earlier quoted context omitted.

Modern PHP is leagues above Javascript

How so?

7.0 added scalar type declarations and a mechanism for strong typing. PHP 8.0 added union types and mixed types. PHP enforces types at runtime, Javascript/Typescript do not. PHP typesystem is built into the language, with Js u either need jsdoc or Typescript both of which wont enforce runtime type checks, Typescript even adds a buildstep. php-fpm allows u to not care about concurrency too much because of an isolated process execution model, with js based apps you need to be extremely careful about concurrency because of how easy you can create and access global stuff. PHP also added a lot of syntax sugar over the time especially with 8.5 my beloved pipe operator. And the ecosystem is not as fragile as Javascripts.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#332

Post by abhisek »

Documenting technical details and payload analysis here: https://safedep.io/shai-hulud-second-coming-supply-chain-att...

Like previous variant, it has credential harvesting, self-replication and GitHub public repository based exfiltration.

Double base64 encoded credentials being exposed using GitHub repositories: https://github.com/search?q=%22Sha1-Hulud%3A%20The%20Second%...

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#333

Post by larusso »

kibwen wrote: post #98
larusso wrote: post #67

Earlier quoted context omitted.

I agree partly. I love cargo and can’t understand why certain things like package namespaces and proof of ownership isn’t added at a minimum. I was mega annoyed when I had to move all our Java packages from jcenter, which was a mega easy setup and forget affair, to maven central. There I suddenly needed to register a group name (namespace mostly reverse domain) and proof that with a DNS entry. Then all packages have…

> But the fact that at least on npm it was possible that someone else grabs a package ID after an author pulled its packages is kind of alarming. Since your comment starts with commentary on crates.io, I'll note that this has never been possible crates.io. > Dependency confusion attacks are still possible on cargo because the whole - vs _ as delimiter wasn’t settled in the beginning. I don't think this has ever been…

The trusted publishing is rather new or? Awesome to see that they implemented it. Just saying that maven central required it already years ago.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#334

Post by tasuki »

merelysounds wrote: post #34
vintagedave wrote: post #14

The list of packages looks like these are not just tiny solo-person dependencies-of-dependencies. I see AsyncAPI and Zapier there. Am I right that this seems quite a significant event? AsyncAPI is used as the example in the post. It says the Github repo was not affected, but NPM was. What I don't understand from the article is how this happened. Were the credentials for each project leaked? Given the wide range of pa…

There is an explanation in the article: > it modifies package.json based on the current environment's npm configuration, injects [malicious] setup_bun.js and bun_environment.js, repacks the component, and executes npm publish using stolen tokens, thereby achieving worm-like propagation. This is the second time an attack like this happens, others may be familiar with this context already and share fewer details and ex…

I don't get this explanation. How does it force you to run the infection code?

Yes, if you depend on an infected package, sure. But then I'd expect not just a list, but a graph outlining which package infected which other package. Overall I don't understand this at all.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#335

Post by Yokohiii »

__s wrote: post #221
Ygg2 wrote: post #55

Earlier quoted context omitted.

I don't buy this line of reasoning. There are zero/one day vulnerabilities that will get extra time to spread. Also, if everyone switches to the same cooldown, wouldn't this just postpone the discovery of future Shai-Huluds? I guess the latter point depends on how are Shai-Huluds detected. If they are discovered by downstreams of libraries, or worse users, then it will do nothing.

There are companies like Helix Guard scanning registries. They advertise static analysis / LLM analysis, but honeypot instances can also install packages & detect certain files like cloud configs being accessed

But relying on the goodwill of commercial sec vendors is it's own infrastructure risk.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#336

Post by jackconsidine »

Used the following script to see if I had any affected packages:

https://gist.github.com/considine/2098a0426b212f27feb6fb3b4d...

It checks yarn.lock for any of the above. Maybe needs a tweak or two but you should be able to run from a directory with yarn.lock

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#337

Post by 15155 »

bhouston wrote: post #264
dwroberts wrote: post #124

Earlier quoted context omitted.

I think this is right about Rust and Cargo, but I would say that Rust has a major advantage in that it implements frozen + offline mode really well (which if you use, obviously significantly decreases the risks). Any time I ever did the equivalent with NPM/node world it was basically unusable or completely impractical

Pnpm (a very popular npm replacement) makes completely locked packages easy and natural and ultra fast: https://pnpm.io/cli/install Benchmarks: https://pnpm.io/benchmarks

pnpm is so laughably terrible compared to Cargo it's not even comparable in the same breath.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#338

Post by dotancohen »

whizzter wrote: post #282
dotancohen wrote: post #29

Earlier quoted context omitted.

Historically, arguments of "it's popular so that's why it's attacked" have not held up. Notable among them was addressing Windows desktop security vulnerabilities. As Linux and Mac machines became more popular, not to mention Android, the security vulnerabilities in those burgeoning platforms never manifested to the extent that they were in Windows. Nor does cargo or pip seem to be infected with these problems to the…

Compared to the JS ecosystem and number of users both Python and Rust are puny, also the the NPM ecosystem also allowed by default for a lot of post-install actions since they wanted to enable a smooth experience with compiling and installing native modules (Not entirely sure how Cargo and PIP handles native library dependencies). As for Windows vs the other OS's, yes even the Windows NT family grew out of DOS and Wi…

This comment seems to address users intentionally installing malware. I mean to address cracking, the situation where an attacker gains root or installs software that the user does not know about.

Preventing the user from installing something that they want to install is another issue completely. I'm hesitant to call it exactly security, though I agree that it falls under the auspices of security.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#340

Post by threetonesun »

rock_artist wrote: post #222
sph wrote: post #7

Earlier quoted context omitted.

It's not "node" or "Javascript" the problem, it's this convenient packaging model. This is gonna ruffle some feathers, but it's only a matter of time until it'll happen on the Rust ecosystem which loves to depend on a billion subpackages, and it won't be fault of the language itself. The more I think about it, the more I believe that C, C++ or Odin's decision not to have a convenient package manager that fosters a ca…

Using C++ daily, whenever I do js/ts are some javascript variant, since I don't use it daily, and update becomes a very complex task. frameworks and deps change APIs very frequently. It's also very confusing (and I think those attack vectors benefit exactly from that), since you have a dependency but the dep itself dependent on another dep version. Building basic CapacitorJS / Svelte app as an example, results many d…

Don't use a framework? Loading a JS script on a page that says "when a update b" hasn't changed much in about 20 years.

Maybe I'm being a bit trite but the world of JavaScript is not some mysterious place separate from all other web programming, you can make bad decisions on either side of the stack. These comments always read like devs suddenly realizing the world of user interactions is more complicated and has more edge cases than they think.

Post reply on HN