Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

socket.dev

Post reply on HN
Print view View original

371–380 of 1001 posts

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#371

Post by chuckadams »

Liskni_si wrote: post #345
chuckadams wrote: post #342

Earlier quoted context omitted.

npm will use your lockfile if it’s present, otherwise yeah it’s pretty much whatever is tagged and latest at the time (and the version doesn’t even have to change). If npm respected every upstream lockfile, then it could never share a single version that satisfied all dependencies. The bigger issue here is that npm has such unrestricted and unsupervised access to the entire environment at all.

> If npm respected every upstream lockfile, then it could never share a single version that satisfied all dependencies. I'm asking in the context of installing a single CLI tool into ~/bin or something. There's no requirement to satisfy all dependencies, because the only dependency I care about is that one CLI tool. All I want is an equivalent of what `cargo install --locked` does — use the top-level lockfile of the…

That sounds pretty reasonable: npm should allow bundling the lockfile with things that are marked with the type of "project", and whether it actually uses them depending on whether other locked constraints are overriding it. So instead of one lockfile, a prioritized list of them. The UX of dealing with that list could be a sticky wicket though, and npm isn't known for making this stuff easy to begin with.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#372

Post by LPisGood »

g42gregory wrote: post #369

Are Python packaging systems like pip exposed to the same risks? Is anybody looking at this?

Software supply chain attacks are well known and they are a massive hole in the entirety of software infrastructure. As usual with security, no one really cares that much.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#373

Post by LPisGood »

RUnconcerned wrote: post #74
zachrip wrote: post #38

Earlier quoted context omitted.

I can tell a lot about a dev by the fact that they single out npm/js for this supply chain issue.

What other language ecosystems have had this happen systematically? This isn't even the first time this month!

Go has this issue

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#374

Post by thewebguyd »

ronsor wrote: post #331
thewebguyd wrote: post #320

Earlier quoted context omitted.

Why even put a package download count on it? Just require it for everything submitted to NPM. It's not hard.

Because then it's extra hassle and expense for new developers to publish a package, and we're trying to keep things decentralized.

It's already centralized by virtue of using and relying on NPM as the registry.

If we want decentralized package management for node/javascript, you need to dump NPM - why not something like Go's system which is actually decentralized? There is no package repository/registry, it's all location based imports.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#375

Post by LeifCarrotson »

dist-epoch wrote: post #254
LeifCarrotson wrote: post #82

Earlier quoted context omitted.

It's both that and a culture of installing a myriad of constantly-updating, tiny libraries to do basic utility functions. (Not even libraries, they're more like individual pages in individual books). In our line-of-business .NET app, we have a logger, a database, a unit tester, and a driver for some specialty hardware. We upgrade to the latest version of each external dependency about once per year (every major versi…

> Slipping a malicious package into pypi could expose all kinds of juicy, proprietary data > In July 2024, Bittensor users were the victims of an $8 million hack. The Bittensor hack was an example of a supply chain hack using PyPI. PyPI is a site that hosts packages for the Python programming language https://www.halborn.com/blog/post/explained-the-bittensor-ha...

Yes, there are hackers on every platform... but it feels like there's an NPM compromise announced about once a week.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#376

Post by rlpb »

kirici wrote: post #351
rlpb wrote: post #303

Earlier quoted context omitted.

There is another related growing problem in my recent observation. As a Debian Developer, when I try to audit upstream changes before pulling them in to Debian, I find a huge amount of noise from tooling, mostly pointless. This makes it very difficult to validate the actual changes being made. For example, an upstream bumps a version of a lint tool and/or changes style across the board. Often these are labelled "chor…

I'm using difftastic, it cuts down a whole lot of the noise https://difftastic.wilfred.me.uk/

This looks good! Unfortunately it looks like it also suffers from exactly the same software supply chain problem that we need to avoid in the first place: https://github.com/Wilfred/difftastic/blob/master/Cargo.lock

Edit: also, consider how much of https://github.com/Wilfred/difftastic/commits/master/ is just noise in itself. 15k commits for a project that appears to only be about four years old.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#377

Post by spankalee »

pixl97 wrote: post #240
spankalee wrote: post #186

Earlier quoted context omitted.

Sandboxing doesn't do any good if the malicious code and target data are in the same sandbox, which is the whole point of these supply-chain attacks.

I mean, what does do good if your supply chain is attacked? This said, less potential vendors supplying packages 'may' reduce exposure, but doesn't remove it. Either way, not running the bleeding edge packages unless it's a known security fix seems like a good idea.

The supply chain infrastructure needs to stop being naive and allowing for insecure publishing.

- npm should require 2FA disallow tokens for publishing. This is an option, but it should be a requirement.

- npm should require using a trusted publisher and provenance for package with over 100k downloads a week and their dependencies.

- Github should require a 2FA step for automated publishing

- npm should add a cool down period where if won't install brand new packages without a flag

- npm should stop running postinstall scripts.

- npm should have an option to not install packages without provenance.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#378

Post by dmix »

adhamsalama wrote: post #350
dmix wrote: post #330

Earlier quoted context omitted.

Even minor styling rule changes would result in a huge PR across our frontend so I tend to avoid any change in tooling. But using old tools is not the end of the world. I only upgrade ESLint because I had to upgrade something else.

Would omitting this commit from git blame solve the issue?

Oh that's a great idea. I forgot about git --ignore-revs

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#379

Post by jahsome »

acomjean wrote: post #344
foobarbecue wrote: post #274

Earlier quoted context omitted.

Can't help noticing, in the original article: > The entire attack design assumes Linux or macOS execution environments, checking for os.platform() === 'linux' || 'darwin'. It deliberately skips Windows systems If I were the conspiracy-minded sort I might jump to some wild conclusions here.

I’m using windows again. By default windows has “power shell” which is not at all like bash and is (how do I say this diplomatically)… wanting. I mean it says something the developed the Linux Subsystem for Windows, but it’s an optional install.

What dont you like about powershell?

I'm a die hard linux user, and some years ago took a windows gig on a whim. I find powershell fantastic and the only thing that makes my role bearable. Now, one of the first things i install on Linux is powershell.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#380

Post by nromiun »

g42gregory wrote: post #369

Are Python packaging systems like pip exposed to the same risks? Is anybody looking at this?

Not to the same extent as NPM. Because Python has a good standard library and library authors are not deathly afraid of code duplication like JS devs, for example micro libraries like left-pad, is-even etc.
Post reply on HN