Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM debug and chalk packages compromised

aikido.dev

Post reply on HN
Print view View original

401–410 of 796 posts

Re: NPM debug and chalk packages compromised

#401

Post by Imustaskforhelp »

hackerindio wrote: post #215
junon wrote: post #9

Hi, yep I got pwned. Sorry everyone, very embarrassing. More info: - https://github.com/chalk/chalk/issues/656 - https://github.com/debug-js/debug/issues/1005#issuecomment-3... Affected packages (at least the ones I know of): - ansi-styles@6.2.2 - debug@4.4.2 (appears to have been yanked as of 8 Sep 18:09 CEST) - chalk@5.6.1 - supports-color@10.2.1 - strip-ansi@7.1.1 - ansi-regex@6.2.1 - wrap-ansi@9.0.1 - color-conve…

Hey, no problem, man. You do a lot for the community, and it's not all your fault. We learn from our mistakes. I was thinking of having a public fake profile to avoid this type of attack, but I'm not sure how it would work on the git tracking capabilities. Probably keeo it only internally for you&NPM ( the real one ) and have some fake ones open for public but not sure, just an obfuscated idea. Thanks for taking the…

Wow, that's actually kinda genius not gonna lie. Honestly, I would love seeing some 2fa or some other way to prevent pwning. Maybe having a sign up with google with all of its flaws still might make sense given how it might be 2fa.

But google comes with its own privacy nightmares.

Re: NPM debug and chalk packages compromised

#402

Post by pixl97 »

IshKebab wrote: post #217
austin-cheney wrote: post #167

Earlier quoted context omitted.

I can provide you with some missing background as I was a prior full time JavaScript/TypeScript developer for 15 years. Most people writing JavaScript code for employment cannot really program. It is not a result of intellectual impairment, but appears to be more a training and cultural deficit in the work force. The result is extreme anxiety at the mere idea of writing original code, even when trivial in size and sc…

Not my experience at all. It's more like a) JS devs view NPM packages as a mark of pride and so they try to make as many as possible (there are people proud of maintaining hundreds of packages, which is obviously dumb), and b) people are lazy and will take a ready-made solution if it's available, and c) there are a lot of JavaScript developers. The main reasons you don't see this in other languages is they don't have…

It seems in some large businesses code ownership is an issue too.

If you NPM import that's now part of your SCA/SBOM/CI to monitor and keep secure.

If you write code, it's now your problem to secure and manage.

Re: NPM debug and chalk packages compromised

#403

Post by OptionOfT »

billywhizz wrote: post #350
aabbccsmith wrote: post #211

Earlier quoted context omitted.

npm's recent provenance feature fixes this, and it's pretty easy to setup. It will seriously help prevent things like this from ever happening again, and I'm really glad that big packages are starting to use it.

> When a package in the npm registry has established provenance, it does not guarantee the package has no malicious code. Instead, npm provenance provides a verifiable link to the package's source code and build instructions, which developers can then audit and determine whether to trust it or not

It prevents the npm publish from locally modified source code.

Re: NPM debug and chalk packages compromised

#404

Post by dmitrygr »

hunter2_ wrote: post #326
yifanl wrote: post #273

Earlier quoted context omitted.

Asking people to run random install scripts just feels very out of place given the context.

I would agree if this were one of those `curl | sh` scenarios, but don't we consider things like `brew` to be sufficiently low-risk, akin to `apt`, `dnf`, and the like?

> don't we consider things like `brew` to be sufficiently low-risk,

Like ... npm?

Re: NPM debug and chalk packages compromised

#405

Post by Fishkins »

nothrabannosir wrote: post #392
skrebbel wrote: post #203

Earlier quoted context omitted.

yes. ripgrep just does it faster, is all.

But also respects .gitignore by default so I’m not sure you want to use ripgrep to scan your node_modules

For others who didn't know, the -u flag in the OP's command makes it so ripgrep _will_ search files even if they're gitignored

Re: NPM debug and chalk packages compromised

#406

Post by xorcist »

austin-cheney wrote: post #167
stathibus wrote: post #18

As an outsider to the npm ecosystem, reading this list of packages is astonishing. Why do js people import someone else's npm module for every little trivial thing?

I can provide you with some missing background as I was a prior full time JavaScript/TypeScript developer for 15 years. Most people writing JavaScript code for employment cannot really program. It is not a result of intellectual impairment, but appears to be more a training and cultural deficit in the work force. The result is extreme anxiety at the mere idea of writing original code, even when trivial in size and sc…

If Javascript people were bad programmers, we wouldn't see two new frontend frameworks per year. Many of them are ambitious projects that must have had thousands of hours put in by people who know the language well.

The observation is real however. But every culture develops its own quirks and ideas, and for some reason this has just become a fundamental part of Javascript's. It's hard to know why after the fact, but perhaps it could spark the interest of sociologists who can enlighten us.

Re: NPM debug and chalk packages compromised

#407

Post by PeterisP »

palmfacehn wrote: post #147
imiric wrote: post #82

Earlier quoted context omitted.

To be fair, this is not a problem with the web itself, but with the Node ecosystem. It's perfectly possible to build web apps without relying on npm at all, or by being very selective and conservative about the packages you choose as your direct and transitive dependencies. If not by reviewing every line of code, then certainly by vendoring them. Yes, this is more inconvenient and labor intensive, but the alternative…

I'm often surprised at the number of JS experts who struggle with the basics of the browser API. Instead of reasoning through the problem, many will reach for a framework or library.

At least historically it used to be the case that you don't ever want to use the browser API directly for compatibility reasons but always through some library that will be a do-nothing-wrapper in some cases but do a bunch of weird stuff for older browsers. And traditions are sticky.

Re: NPM debug and chalk packages compromised

#408

Post by gaudystead »

Vincenius wrote: post #126

Wow, I also received the same phishing email even though my packages only have a few hundred downloads a week (eg. bsky-embed). So I guess a lot more accounts/packages might be affected than the ones stated in the article

Did you receive the email in a similar time window? I'm trying to think of ways to scan other repositories for signs of compromise.

Re: NPM debug and chalk packages compromised

#409

Post by cluckindan »

lelanthran wrote: post #376
notmyjob wrote: post #184

Earlier quoted context omitted.

Agree, but this example wasn’t even that aggressive in its urgency and op said they were merely ticking things off the todo, not feeling alarmed by the urgency. The problem is email as it’s used currently. The solution is to not use email.

> The problem is email as it’s used currently. The solution is to not use email. No. The problem is unsigned package repositories. The solution is to tie a package to an identity using a certificate. Quickest way I can think off would be requiring packages to be linked to a domain so that the repository can always check incoming changes to packages using the incoming signature against the domain certificate.

And one pwned domain later, we are back in square one.

Re: NPM debug and chalk packages compromised

#410

Post by PokestarFan »

bnchrch wrote: post #341
PokestarFan wrote: post #174

Earlier quoted context omitted.

NPM is owned by GitHub and therefore Microsoft, who is too busy putting in Copilot into apps that have 0 reason to have any form of generative AI in them

Good god. Not everything has to be about your opinion on AI.

GitHub was folded into Microsoft's "CoreAI" team. Not very confidence-inspiring.
Post reply on HN