Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious npm packages detected across Red Hat Cloud Services

github.com

Post reply on HN
Print view View original

411–420 of 494 posts

Re: Malicious npm packages detected across Red Hat Cloud Services

#411

Post by ffemac »

make3 wrote: post #340
eranation wrote: post #234

Hope it's ok I hijack this thread again about setting up cooldowns... (copy pasting my last comment when tanstack was compromised): I know people have opinions about cooldowns, but they would have saved you from axios, tanstack, (+ @redhat-cloud-services) and many other recent npm supply chain attacks. If you have Artifactory / Nexus, you probably already have cooldowns, but it's easy to set up if you don't. Why cool…

theoretical question, do cooldowns still work if everyone has them?

No, it will stop working. The whole point of min age is letting someone else taste the food before you, so you are not poisoned. (except maybe scanners but they can't detect everything and the payloads will highly likely to remain dormant when it detected it's within a scanning env).

BTW it will only get much worse because popular AI coding harness (e.g. OpenCode/KiloCode) will just download random npm packages in the background without you knowing. And the devs don't care.

Re: Malicious npm packages detected across Red Hat Cloud Services

#412

Post by QuiEgo »

eranation wrote: post #234

Hope it's ok I hijack this thread again about setting up cooldowns... (copy pasting my last comment when tanstack was compromised): I know people have opinions about cooldowns, but they would have saved you from axios, tanstack, (+ @redhat-cloud-services) and many other recent npm supply chain attacks. If you have Artifactory / Nexus, you probably already have cooldowns, but it's easy to set up if you don't. Why cool…

As an embedded dev who’s used to locking to toolchains and deps for years at a time, web dev is a culture shock in so many ways.

Re: Malicious npm packages detected across Red Hat Cloud Services

#413

Post by QuiEgo »

ffemac wrote: post #411
make3 wrote: post #340

Earlier quoted context omitted.

theoretical question, do cooldowns still work if everyone has them?

No, it will stop working. The whole point of min age is letting someone else taste the food before you, so you are not poisoned. (except maybe scanners but they can't detect everything and the payloads will highly likely to remain dormant when it detected it's within a scanning env). BTW it will only get much worse because popular AI coding harness (e.g. OpenCode/KiloCode) will just download random npm packages in th…

Kind of depends. If someone looses control of their credentials and notices someone using their account to post, it still might help.

Re: Malicious npm packages detected across Red Hat Cloud Services

#414

Post by charcircuit »

cluckindan wrote: post #398
chillax wrote: post #346

Earlier quoted context omitted.

Companies such as socket and safedep will still scan new packages and alert on malware (if they are able to detect it) so the packages are taken down before they pass your cool down

It’s kind of insane this doesn’t happen in the publish pipeline by default.

This is what serious software distribution platforms do. Developers may think that they are special and they would never install malware, but that's just not the case.

Re: Malicious npm packages detected across Red Hat Cloud Services

#415

Post by smrtinsert »

QuiEgo wrote: post #412
eranation wrote: post #234

Hope it's ok I hijack this thread again about setting up cooldowns... (copy pasting my last comment when tanstack was compromised): I know people have opinions about cooldowns, but they would have saved you from axios, tanstack, (+ @redhat-cloud-services) and many other recent npm supply chain attacks. If you have Artifactory / Nexus, you probably already have cooldowns, but it's easy to set up if you don't. Why cool…

As an embedded dev who’s used to locking to toolchains and deps for years at a time, web dev is a culture shock in so many ways.

There's literally no excuse - I'm still baffled.

Re: Malicious npm packages detected across Red Hat Cloud Services

#416

Post by jmb99 »

mercurywells wrote: post #386
jmb99 wrote: post #358

Earlier quoted context omitted.

Changing oil requires > a place where you have sufficient access to the vehicle to drain it Probably the only valid argument for people who park on the street. > the right equipment One $5 wrench, one $10 filter wrench (optional). One set of ramps ($40), or jack stands ($30) if you already have a jack. One drain pan, $10 (or free if you're resourceful). Total cost max $65. Cheaper if you look for deals, buy used, bor…

Good job, you forgot a new crush washer and now your oil pan will leak

In ~300k km worth of diy oil changes, I’ve yet to change a crush washer, and yet to have a drain plug leak.

I always replace them on friends’ Toyotas, because they seem more important, but on every car I’ve owned it hasn’t mattered. And if you take the least amount of effort to google “how to change oil on ________” (fill in the blank for your year, make, model), some forum or video will probably tell you exactly what steps to take, including whether or not changing a washer is necessary.

Re: Malicious npm packages detected across Red Hat Cloud Services

#418

Post by [deleted] »

make3 wrote: post #340
eranation wrote: post #234

Hope it's ok I hijack this thread again about setting up cooldowns... (copy pasting my last comment when tanstack was compromised): I know people have opinions about cooldowns, but they would have saved you from axios, tanstack, (+ @redhat-cloud-services) and many other recent npm supply chain attacks. If you have Artifactory / Nexus, you probably already have cooldowns, but it's easy to set up if you don't. Why cool…

theoretical question, do cooldowns still work if everyone has them?

[deleted]

Re: Malicious npm packages detected across Red Hat Cloud Services

#419

Post by isityettime »

nailer wrote: post #269
isityettime wrote: post #227

Earlier quoted context omitted.

Yeah with RPM and dpkg you're trusting the distro, or maybe individual distro maintainers, depending on how you consider it. But there are norms in the distro about what those scripts are for and how to use them, and there's some social enforcement around that. The real issue for hooks in packaging formats like those is when you start adding third-party vendor repositories, e.g., Zoom, Google Chrome, Discord. None of…

> Yeah with RPM and dpkg you're trusting the distro, or maybe individual distro maintainers, depending on how you consider it. Not all packages come from the distro. People can and do enable external sources for software that isn't part of their OS.

Read the third sentence in the comment you're ostensibly replying to, friend.

Re: Malicious npm packages detected across Red Hat Cloud Services

#420

Post by k_sze »

eranation wrote: post #234

Hope it's ok I hijack this thread again about setting up cooldowns... (copy pasting my last comment when tanstack was compromised): I know people have opinions about cooldowns, but they would have saved you from axios, tanstack, (+ @redhat-cloud-services) and many other recent npm supply chain attacks. If you have Artifactory / Nexus, you probably already have cooldowns, but it's easy to set up if you don't. Why cool…

Nice work!

Is there a sensible way to add a cooldown to Docker/Podman image pulling?

Post reply on HN