Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many packages suddenly disappeared

github.com

Post reply on HN
Print view View original

391–400 of 520 posts

Re: Many packages suddenly disappeared

#391

Post by mort96 »

applecrazy wrote: post #262
mort96 wrote: post #149

Earlier quoted context omitted.

https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/ left-pad was a package to, you guessed it, pad a string with n leading characters. Personally, I've always just written my own 2 line function for it (something like `function pad(s, n, ch) { return new Array(n - s.length).fill(ch).join("") + s; }`), but a bunch of packages either directly or indirectly depended on this left-pad package, so they all broke.

Packages broke because of a literal two line function? That's hilarious and terrifying at the same time.

Well... No. the left-pad function is 11 lines. The source code, as it was back then, according to that register article, was like this:

function leftpad (str, len, ch) {

  str = String(str);

  var i = -1;

  if (!ch && ch !== 0) ch = ' ';

  len = len - str.length;

  while (++i
}

But yes, packages broke because of what _could_ have been implemented in one line (ignoring the two lines for the function signature and closing curly).

Re: Many packages suddenly disappeared

#392

Post by Natanael_L »

MagicWishMonkey wrote: post #356
zbentley wrote: post #345

Earlier quoted context omitted.

No. Packages would not need to be installed as root. Additionally, many possible ways to use the exploit in GP could run as unprivileged users.

Wouldn't the package need to be executed as root, though? Or does spectre/meltdown not require privileged access?

No, that's the entire point. They need almost nothing at all but the ability to run code fast in a loop with memory calls. The entire point is that they bypass privilege checks.

Re: Many packages suddenly disappeared

#393

Post by Iv »

I wish the NPM community would grow some humility and learn some lessons about how the debian environment was built. Have sane licensing that allows mirroring, have crypto-hash of packets. Have open governance.

Re: Many packages suddenly disappeared

#394

Post by didibus »

tetha wrote: post #209
maxander wrote: post #179

Earlier quoted context omitted.

> If we can't notice the malicious code at all until due to really really smart activation mechanisms... well then we're in NSA conspiracy land again. What about really dumb activation methods? I.e., a condition that only triggers malicious behavior several months after the date the package was subverted. You don’t have to be the NSA to write that. What’s scary here is that there are simpleminded attacks that, AFAIK,…

Mh, I have a rather aggressive stance on these kind of incidents, no matter if they are availability or security related. You can fish for them, you can test for them, and there are entire classes of malicious code you cannot find. For everything you do, turing complete code can circumvent it. There's a lot of interesting reading material going on in the space of malware analysis regarding sandbox detection, for exam…

What if it encrypts user data?

Re: Many packages suddenly disappeared

#395

Post by didibus »

razorunreal wrote: post #366
dmitriid wrote: post #172

Earlier quoted context omitted.

On top of that, they way countless packages are used everywhere is potentially exploitable: https://medium.com/@david.gilbertson/im-harvesting-credit-ca...

In case anyone was considering sending him $10, no, his hypothetical code would not be running on the Google login page. Google does not pull in external dependencies willy nilly like that.

I'd be surprised if they ran a thorough security audit on all code they import, but I'd rather believe they do.

Re: Many packages suddenly disappeared

#396

Post by jknoepfler »

mikestew wrote: post #359
sandworm101 wrote: post #352

Earlier quoted context omitted.

Because the bible version isnt subject to copyright takedowns.

Start posting large parts of, say, the New International Version, let me know how that goes for you. IOW, unless it’s the King James, it is likely very much subject to take down notices. Though I’m guessing a malicious troll is much more likely to know The Byrds than they are Old Testament.

that is, in fact, the king james version.

Re: Many packages suddenly disappeared

#398

Post by Rapzid »

nukeop wrote: post #95
swang wrote: post #64

Earlier quoted context omitted.

this is not a response? http://blog.npmjs.org/post/168978377570/new-package-moniker-...

That's okay, but it's not enough - it's easy to swap two letters and do similar substitutions to fool many users. If a package is downloaded 10,000 times every day, surely once in a while someone will misspell the name somehow. Other than that, their reaction to similar incidents was to wait for somebdoy on twitter to notify them, ban the responsible users, and hope that it won't happen again. It's still extremely ex…

They could(should?) implement edit distance checks on all new packages against existing packages. If the name is too similar to an existing package name it requires approval.

Re: Many packages suddenly disappeared

#399

Post by electric_sheep »

yashap wrote: post #357
seldo wrote: post #268

Hi folks, npm COO here. This was an operational issue that we worked to correct. All packages are now restored: https://status.npmjs.org/incidents/41zfb8qpvrdj

Were any of the deleted packages temporarily hijacked? It seems strongly like this was the case. If so, please confirm immediately so people who installed packages during this time can start scanning for malware. Even if the answer is “yes, 1+ packages were hijacked by not-the-original author, but we’re still investigating if there was malware”, tell people immediately. Don’t wait a few days for your investigation an…

I would also hope for and expect this to be communicated ASAP from the NPM org to its users.

@seldo, I understand that you don't want to disseminate misleading info, but an abundance of caution seems warranted in this case as my understanding of the incident lines up with what @yashap has said. If we're wrong, straighten us out --- if we're not, please sound an advisory, because this is major.

Re: Many packages suddenly disappeared

#400

Post by xauronx »

TeMPOraL wrote: post #192
rootlocus wrote: post #167

> I was here. > We made history! Fastest issue to reach 1000 comments, in just 2 hours. > cheers everyone, nice chatting with you. 17 away from hitting 1000 btw! > Is GitHub going to die with the volume of comments? Kind of disappointed the NPM community is turning github into reddit right now.

There's probably a large overlap between the two communities.

Considering almost every human I know uses Reddit in some capacity (technical and non-technical), that's pretty likely.
Post reply on HN