Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud Returns: Over 300 NPM Packages Infected

helixguard.ai

Post reply on HN
Print view View original

571–580 of 797 posts

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#571

Post by edoceo »

halflife wrote: post #552
twistedpair wrote: post #469

ProTip: use PNPM, not NPM. PNPM 10.x shutdown a lot of these attack vectors. 1. Does not default to running post-install scripts (must manually approve each) 2. Let's you set a min age for new releases before `pnpm install` will pull them in - e.g. 4 days - so publishers have time to cleanup. NPM is too insecure for production CLI usage. And of course make a very limited scope publisher key, bind it to specific packa…

What does it do with packages that download binaries for specific architecture in the post script?

As stated, you manually approve them.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#572

Post by c-hendricks »

madeofpalk wrote: post #569
twistedpair wrote: post #469

ProTip: use PNPM, not NPM. PNPM 10.x shutdown a lot of these attack vectors. 1. Does not default to running post-install scripts (must manually approve each) 2. Let's you set a min age for new releases before `pnpm install` will pull them in - e.g. 4 days - so publishers have time to cleanup. NPM is too insecure for production CLI usage. And of course make a very limited scope publisher key, bind it to specific packa…

You shouldn't have any keys anywhere at all. Use OIDC https://docs.npmjs.com/trusted-publishers Unfortunately you need to `npm login` with username and password in order to publish the very first version of a package to set up OIDC.

A whole single supported CI partner outside their own corporate family. They really planned this out well.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#574

Post by halflife »

madeofpalk wrote: post #570
halflife wrote: post #552

Earlier quoted context omitted.

What does it do with packages that download binaries for specific architecture in the post script?

You don't need post-install scripts for this. Use optionalDependencies instead https://github.com/nrwl/nx/blob/master/packages/nx/package.j... Each of those deps contains a constraint installing only for the relevant platform.

That’s cool, now I wish all libraries that need binaries would opt to use that instead of post script

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#575

Post by chasd00 »

tomaytotomato wrote: post #45

Could npm adopt a reverse domain naming system similar to Java's for Maven libraries? com.foo.bar That would require domain verification, but it would add significant developer friction. Also mandatory Dune reference: "Bless the maker and his water"

Some MFA requirement to publish a new version of the package would be a good idea. In me experience releasing a new version of software is a big enough deal that the product owner is on hand to authorize the release via a separate device no matter how automated the pipeline is.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#576

Post by hinkley »

Etheryte wrote: post #558
xnorswap wrote: post #452

Perhaps it's time to organize a curated "stable" stream for npm packages. If I want more stability for my OS I can choose Debian-stable rather than Ubuntu-nightly. But for npm, there doesn't seem to be the same choice available. Either I sign up to the fire-hose or I don't. I can choose to only upgrade once a month, but there's a chance I'm still getting a package that dropped 5 minutes before.

Upgrading once a month is insane at any rate, I could see the point in upgrading maybe once a year. For stable projects, you're very much fine upgrading only when there's a vulnerability or you need something from a newer release. Upgrade when you actually need to and use stable versions that have been out for a while, no need to hamster wheel it.

When I worked in commercial aerospace, before we even shipped live there was an incident with a CERT advisory against the XML package we were using. But the fix was only added to the current major version and we were stuck one behind. It took ~3 of our best problem solvers about a week to get that damned thing upgraded. Which put us behind on our schedule.

This made some of my more forward thinking coworkers nervous because what if this happened after we went live? So we started a repeating story called “upgrade dependencies” and assigned it round robin once a month to someone on each application. Every time someone got it the first time they would ask me, “but upgrade what?” Whatever you want, but preferable something that hasn’t been in a while.

For IP and security reasons we were already on vendored dependencies, so it was pretty straightforward to tell what was old. But that made “upgrade immediately” problematic if fixes weren’t back ported far enough and we didn’t want that live.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#577

Post by exceptione »

kunley wrote: post #433
exceptione wrote: post #274

Earlier quoted context omitted.

Respectfully disagree. Python and Go std lib do not even play in the same league. I had to help someone with datetime¹ handling in Python a while back. The stdlib is so poor, you have to reach out for a thirdparty lib for even the most basic of tasks². Don't take my word for it, take a dive. You wouldn't be the first to have adjust their view. For example, this section is just about the built-in web framework asp.net…

You helped someone with Python, and what evidence do you have justifying your claims about alleged Go stdlib narrowness?

Online documentation: https://pkg.go.dev/std

Let me know if I look at the wrong place.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#578

Post by chasd00 »

snickerbockers wrote: post #374

Why does every major Javascript vulnerability come off as something that would be easily avoided by not doing obviously stupid things (in this case automatically updating packages with no authentication, testing or oversight)?

Coding boot camps.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#579

Post by 15155 »

bhouston wrote: post #447
15155 wrote: post #337

Earlier quoted context omitted.

pnpm is so laughably terrible compared to Cargo it's not even comparable in the same breath.

Why specifically? Your comment isn't very informative. Anyhow, here a Claude.ai comparison: https://claude.ai/share/72d2c34c-2c86-44c4-99ec-2a638f10e3f0

Because it doesn't perform as advertised: wild amounts of inconsistencies in behavior (within and between versions), performance issues (pnpm exec adds 15s to all shebang'd execution time over npm/yarn/bun/etc.), etc. Version-to-version stability has been traditionally bad - it's half-baked software.

Claude doesn't know this, of course, because it can only read superficial summaries posted on the internet and has zero real experience actually using this dumpster fire.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#580

Post by chasd00 »

westoque wrote: post #12

a concern i have is that it's only a matter of time before a similar attack is done to electron based apps (which also have packages installed using npm). probably worse because it's installed in your computer and can potentially get any information especially given admin privileges.

I’m starting an electronjs project in a few weeks and have been reading up on it. They make a big deal about the difference between the main and renderer processes and security implications. The docs are there and the advice given but it’s up to the developers to follow them.

That leads me to another point. Devs have to take responsibility for their code/projects. Everyone wants to blame npm or something else but, as software developers, you have to take responsibility for the systems you build. This means, among may other things, vetting code your code depends on and protecting the system from randomly updating itself with code you haven’t even heard about.

Post reply on HN