Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Postmortem: TanStack NPM supply-chain compromise

tanstack.com

Post reply on HN
Print view View original

371–380 of 501 posts

Re: Postmortem: TanStack NPM supply-chain compromise

#371

Post by _the_inflator »

I wasn’t affected because TanStack doesn’t feel like the juice is worth the squeeze.

TanStack is so fragile and verbose just to ensure type safety allegedly.

Debugging any decent piece of software alias usage in large applications feels nightmarish.

It is still JavaScript even when it is called TypeScript. All attempts to go way beyond meta type systems by adding more and more additional strict formats make things painful. JS ain’t Java.

TanStack is a cool idea and I value their enthusiasm. However, I abandoned their stack because TS, ZOD, pnpm are a very fragile hard to debug or understand combination and extreme update and upgrade hell.

Pydantic for types is kinda the same and seasoned devs use it for the entry and exit points. The rest is simply Python and here NumPy and the likes.

TanStack is no way saver than npm. No one understands TanStack. Sorry to break it to you. It is security theater and developer hell.

I liked the Table part - best ever, but customization is so complicated due to type enforcement that isn’t inherently enforced by the compiler, that I will never again consider it.

Re: Postmortem: TanStack NPM supply-chain compromise

#373

Post by anthk »

throwaway7356 wrote: post #338
sinsudo wrote: post #283

Earlier quoted context omitted.

Use /usr/bin/sudo yourcommand with any intermediate command not using path but it's real path hard coded. Edited: Previous suggested using \sudo but it depends of the variable path which can be modified by the attacker.

Yeah, works well: $ /usr/bin/sudo() { echo Not the real sudo.; } $ /usr/bin/sudo Not the real sudo. And every other suggestion also doesn't work if the attacker can just replace the shell.

/usr/bin/sudo isn't evaluated as a function under ksh.

Re: Postmortem: TanStack NPM supply-chain compromise

#374

Post by ervine »

_the_inflator wrote: post #371

I wasn’t affected because TanStack doesn’t feel like the juice is worth the squeeze. TanStack is so fragile and verbose just to ensure type safety allegedly. Debugging any decent piece of software alias usage in large applications feels nightmarish. It is still JavaScript even when it is called TypeScript. All attempts to go way beyond meta type systems by adding more and more additional strict formats make things pa…

> No one understands TanStack. Sorry to break it to you.

Damn, all these years of using TanStack libs successfully, and I had to learn it here that I don't understand them.

Re: Postmortem: TanStack NPM supply-chain compromise

#375

Post by anthk »

lrvick wrote: post #335
eviks wrote: post #308

Earlier quoted context omitted.

Why not make a proper link /sudo so you don't have to type out the full path every time, which is very inconvenient? (but the fact that such workarounds are needed still means it's a theater)

A simple LD_PRELOAD command can cause your shell to run "rm -rf /" when you type "/sudo". If your unprivileged user is compromised, you are pretty hosed.

It should be a way to make system env vars (profile.d or simlar) as readonly so every users' shell had these set to empty values and unable to change them.

Re: Postmortem: TanStack NPM supply-chain compromise

#376

Post by SamuelAdams »

Ciantic wrote: post #352

What I want to focus on is mental model of your CI pipeline, and problem with too much YAML, consider this quote: > Cache scope is per-repo, shared across pull_request_target runs (which use the base repo's cache scope) and pushes to main. A PR running in the base repo's cache scope can poison entries that production workflows on main will later restore. This is very difficult to understand, and teach to new people,…

The other advantage with bash is that most developers can run it locally to validate what it is doing and debug issues. With GitHub Actions you need to always commit and push, slowing down the DX.

Re: Postmortem: TanStack NPM supply-chain compromise

#377

Post by vikramkr »

_the_inflator wrote: post #371

I wasn’t affected because TanStack doesn’t feel like the juice is worth the squeeze. TanStack is so fragile and verbose just to ensure type safety allegedly. Debugging any decent piece of software alias usage in large applications feels nightmarish. It is still JavaScript even when it is called TypeScript. All attempts to go way beyond meta type systems by adding more and more additional strict formats make things pa…

> TanStack is no way saver than npm. No one understands TanStack.

Pandas is also in no way safer than pip. Because pandas is a library and pip is a package manager and that comparison makes no sense lmao. It sounds like you maybe don't really get or use typescript and don't even really use like basic mypy style types in python (or don't get the difference between what a zod/pydantic validator does vs what a mypy/typescript type system does - zod is also only on the boundary). Which is OK but but there's a difference between not getting why a stack is useful or not having experience with it versus confidently and comically declaring that nobody else understands types either while seeming not understanding what any of the parts here do

Re: Postmortem: TanStack NPM supply-chain compromise

#378

Post by ryanschaefer »

killerstorm wrote: post #346
sevenzero wrote: post #280

So how many supply chain attacks do we need to actually change things? Feels like I read about new supply chain attacks every day at this point.

A lot of things need to be rebuilt from ground up, and many devs would prefer convenience and tradition

> many devs would prefer convenience and tradition

This is too reductive of the situation.

If it ain’t broke don’t fix it. Except, in this case, unless you have someone tell you it’s broken you won’t even know you need to fix it.

And this is where asymmetry comes in to play. Attackers are free to test and break as much as they want as long as they are silent. Whereas maintainers don’t know if the fix an LLM proposes will actually address the issue or cause some regression elsewhere.

IMO, if Microsoft wants actually good PR around GitHub for once they would offer free LLM security audits on all actions for at least the X most popular repos…

Re: Postmortem: TanStack NPM supply-chain compromise

#379

Post by gorgoiler »

Gigachad wrote: post #136
cube00 wrote: post #41

Please be careful when revoking tokens. It looks like the payload installs a dead-man's switch at ~/.local/bin/gh-token-monitor.sh as a systemd user service (Linux) / LaunchAgent com.user.gh-token-monitor(macOS). It polls api.github.com/user with the stolen token every 60s, and if the token is revoked (HTTP 40x), it runs rm -rf ~/. https://github.com/TanStack/router/issues/7383#issuecomment-...

Realistically if you have installed malware, you need to do a full wipe of your computer anyway.

It’s like if a bandaid fell into the soup pot. You could solve the problem by (A) fishing it out and giving the soup a good boil; or (B) new soup please!
Post reply on HN