Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud Returns: Over 300 NPM Packages Infected

helixguard.ai

Post reply on HN
Print view View original

501–510 of 797 posts

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#501

Post by jacquesm »

user34283 wrote: post #389
jacquesm wrote: post #109

Earlier quoted context omitted.

> I feel like there are merits to your argument but that you have a larger anti-JS bias that's leaking through. Familiarity breeds contempt.

What's the problem? I think JS is great. It's simple, anybody can use it. TypeScript is excellent too. The structural type system is very convenient. It's not going to replace Rust in cases where performance is essential or where you want strict runtime type checking or whatever, but for general use and graphical applications JS seems like a great pick. I often hear people complain about JS, but really, how is it any…

> I often hear people complain about JS, but really, how is it any worse than say Python?

That's not the flex you think it is.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#502

Post by ghurtado »

windward wrote: post #429
QuiEgo wrote: post #361

Earlier quoted context omitted.

It's already happening: https://cyberpress.org/malicious-rust-packages/ My personal experience (YMMV): Rust code takes 2x or 3x longer to write than what came before it (C in my case), but in the end you usually get something much more likely to work, so overall it's kind of a wash, and the product you get is better for customers - you basically front load the cost of development. This is terrible for people working…

In my experience Rust development is no slower than C development (in a different environment) or C++ development (in a comparable project)

I think they were using "writing Rust" in the most strict sense: the part of the development cycle that involves typing the majority of the code, before you really start debugging in earnest and really make things work.

But their point is that "developing Rust" (as in, the entire process) ends up being a similar total effort to C, only with more up front "writing" and less work on the debugging phase.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#503

Post by tripplyons »

twistedpair wrote: post #469

ProTip: use PNPM, not NPM. PNPM 10.x shutdown a lot of these attack vectors. 1. Does not default to running post-install scripts (must manually approve each) 2. Let's you set a min age for new releases before `pnpm install` will pull them in - e.g. 4 days - so publishers have time to cleanup. NPM is too insecure for production CLI usage. And of course make a very limited scope publisher key, bind it to specific packa…

Is there a way to set a minimum release age globally for my pnpm installation? I was only able to find a way to set it for each individual project.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#504

Post by venturecruelty »

phendrenad2 wrote: post #251
amiga386 wrote: post #224

Earlier quoted context omitted.

Static scanning won't help. You can write this["eval"]() instead of eval(), therefore you can write this["e" + "v" + "a" + "l"](), and you can substitute (!![]+[])[!+[]+!+[]+!+[]] for "e", (![]+[])[+!+[]] for "a" (and so on: https://jsfuck.com/ ) In this Turing-equivalent world, you can only know what actually executes (e.g. eval, fetch) by actually executing all code in the package and then see what functions got ex…

There's always some mathematician who tries to prove that locks on your doors "won't help" because the universe is infinite. Narrator: it is not

"Hey, we've figured out how to detect security vulnerabilities! We just need to solve the Halting Problem!"

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#505

Post by mcintyre1994 »

benmccann wrote: post #483

Hundreds of people had access to publish the Zapier SDK, so it's little surprise they were eventually compromised! ( https://bsky.app/profile/benmccann.com/post/3m6fdecsbdk2u ) The e18e community are reducing dependencies in popular libraries and building tools to prevent and reduce the impact of such attacks. Join if you want to help out! https://e18e.dev/ Just this morning, after trying to make the case over the pa…

FYI your first link is the same as your third link. It's correct as the third link, so the Zapier one is missing.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#506

Post by jacquesm »

cluckindan wrote: post #229
DamonHD wrote: post #153

Earlier quoted context omitted.

When I last looked (as a consulting dev in a bank or three, horrified) absolutely they had not!

If this was in the US, all financial institutions need to audit their code to comply with NIST SP 800-53. If they haven’t, it would be ethically dubious for you to not report it.

In theory there is no difference between theory and practice, but in practice there is.

> If they haven’t, it would be ethically dubious for you to not report it.

I can report all I want, someone needs to act on that report for it to have an effect.

There are people out there who think that some static analysis tool plugged into their CI/CD pipeline is the equivalent of a code audit.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#507

Post by venturecruelty »

hedora wrote: post #405
westoque wrote: post #12

a concern i have is that it's only a matter of time before a similar attack is done to electron based apps (which also have packages installed using npm). probably worse because it's installed in your computer and can potentially get any information especially given admin privileges.

I'd really like to know how signal deals with this. It's supposedly super secure + stuff, but it's built on top of this ecosystem.

They probably don't willy-nilly install every new patch that comes down the pike?

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#509

Post by lbhdc »

mlnj wrote: post #471
Lutger wrote: post #457

Earlier quoted context omitted.

Everything runs in the container and cannot escape it. Its like a sandbox. You have to make sure you're not putting any secrets in the container environment.

>You have to make sure you're not putting any secrets in the container environment. How does this work exactly? containers still need env vars and access to databases and cloud environments. Without these the container is just useless isolated pod.

Not who you asked, but I have a similar setup. I can run everything I need for local development in that image (db, message queue emulator, cache, other services). So, setting things like environment variables or running postgres work the same as they do outside the container.

The image itself isn't the same image that the app gets deployed in, but is a portable dev environment with everything needed to build and run my apps baked in.

This comes with some nice side effects like being able to instantly spin up clean work environments on my laptop, someone elses, or a remote vm.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#510

Post by timgl »

silverlight wrote: post #397
timgl wrote: post #4

co-founder of PostHog here. We were a victim of this attack. We had a bunch of packages published a couple of hours ago. The main packages/versions affected were: - posthog-node 4.18.1, 5.13.3 and 5.11.3 - posthog-js 1.297.3 - posthog-react-native 4.11.1 - posthog-docusaurus 2.0.6 We've rotated keys and passwords, unpublished all affected packages and have pushed new versions, so make sure you're on the latest versio…

Did the client side JS being infected produce any issues which would have affected end users? As in if a web owner were on an affected version and deployed during the window would the end user of their site have had any negative impact?

No, just the host that was running the package (the exploit was pretty generic and not targeted at PostHog specifically). In fact, so far we think there were 0 production deployments of PostHog because the package was only live for a little bit.
Post reply on HN