Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

socket.dev

Post reply on HN
Print view View original

381–390 of 1001 posts

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#381

Post by ncruces »

Meneth wrote: post #91

This happens because there's no auditing of new packages or versions. The distro's maintainer and the developer is the same person. The general solution is to do what Debian does. Keep a stable distro where new packages aren't added and versions change rarely (security updates and bugfixes only, no new functionality). This is what most people use. Keep a testing/unstable distro where new packages and new versions can…

This is a culture issue with developers who find it OK to have hundreds of (transitive) dependencies, and then follow processes that, for all intents and purposes, blindly auto update them, thereby giving hundreds of third-parties access to their build (or worse) execution environments.

Adding friction to the sharing of code doesn't absolve developers from their decision to blindly trust a ridiculous amount of third-parties.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#382

Post by Hackbraten »

HillRat wrote: post #178
reactordev wrote: post #70

Earlier quoted context omitted.

Until you go get malware Supply chain attacks happen at every layer where there is package management or a vector onto the machine or into the code. What NPM should do if they really give a shit is start requiring 2FA to publish. Require a scan prior to publish. Sign the package with hard keys and signature. Verify all packages installed match signatures. Semver matching isn’t enough. CRC checks aren’t enough. This h…

Sign the package with hard keys and signature. That's really the core issue. Developer-signed packages (npm's current attack model is "Eve doing a man-in-the-middle attack between npm and you," which is not exactly the most common threat here) and a transparent key registry should be minimal kit for any package manager, even though all, or at least practically all, the ecosystems are bereft of that. Hardening API sur…

How are users supposed to build and maintain a trust store?

In a hypothetical scenario where npm supports signed packages, let's say the user is in the middle of installing the latest signed left-pad. Suddenly, npm prints a warning that says the identity used to sign the package is not in the user's local database of trusted identities.

What exactly is the user supposed to do in response to this warning?

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#383

Post by LPisGood »

octo888 wrote: post #281
codazoda wrote: post #231

Earlier quoted context omitted.

Somehow I didn't realize GitHub purchased npm in 2020. GitHub is the second word on npmjs.org. How did I not notice?

Microsoft: GitHub, NPM, typescript, VS Code, OpenAI, Playwright A lot of fingers in a lot pies

I believe someone working there once said “Developers, developers, developers, developers, developers!

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#384

Post by chatmasta »

foobarbecue wrote: post #274
progbits wrote: post #220

Earlier quoted context omitted.

NPM is owned by github/microsoft. I'm sure they could afford to buy one of these products or just build their own, but clearly security is not a thing they care about.

Can't help noticing, in the original article: > The entire attack design assumes Linux or macOS execution environments, checking for os.platform() === 'linux' || 'darwin'. It deliberately skips Windows systems If I were the conspiracy-minded sort I might jump to some wild conclusions here.

Whoever made the exploit probably doesn’t use windows.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#385

Post by paulddraper »

Maskawanian wrote: post #348
paulddraper wrote: post #225

Earlier quoted context omitted.

Go’s package repository is just GitHub. At the end of the day, it’s all a URL. You’re asking for a blessed set of URLs. You’d have to convince someone to spend time maintaining that.

Golang at least gives you the option to easily vendor-ize packages to your local repository. Given what has happened here, maybe we should start doing this more!

npm has always downloaded to the current directory.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#387

Post by LPisGood »

ronsor wrote: post #331
thewebguyd wrote: post #320

Earlier quoted context omitted.

Why even put a package download count on it? Just require it for everything submitted to NPM. It's not hard.

Because then it's extra hassle and expense for new developers to publish a package, and we're trying to keep things decentralized.

I don’t understand what benefits this kind of “decentralization” offers

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#388

Post by 1970-01-01 »

mrbluecoat wrote: post #197

> It deliberately skips Windows systems Reminds me of when I went to a tech conference with a Windows laptop and counted exactly two like me among the hundreds of attendees. I was embarrassed then but I'd be laughing now :D

..for now. Safer to assume there was a todo in the code and not some anti-Linux agenda.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#389

Post by whizzter »

silverwind wrote: post #321
Meneth wrote: post #91

This happens because there's no auditing of new packages or versions. The distro's maintainer and the developer is the same person. The general solution is to do what Debian does. Keep a stable distro where new packages aren't added and versions change rarely (security updates and bugfixes only, no new functionality). This is what most people use. Keep a testing/unstable distro where new packages and new versions can…

So, who is going to audit the thousands of new packages/versions that are published to npm every day? It only works for Debian because they hand-pick popular software.

This is maybe where we could start getting into money into the opensource ecosystems.

One idea I've had is that publishing is open as today, but security firms could offer audit signatures.

So a company might pay security firms and only accept updates to packages that have been audited by by 1,2,3 or more of their paid services.

Thus money would be paid in the open to have eyes on changes for popular packages and avoid the problem of that weird lone maintainer in northern Finland being attacked by the Chinese state.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#390

Post by indigodaddy »

Ironically I started seeing a message in GitHub saying 2fa will be auto-enforced shortly. Wonder if that is a sign of similar for npm packaging?

Or wonder if GitHub is enforcing 2fa soon because of the NPM CVEs potential to harvest GitHub creds?

Post reply on HN