Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You too can run malware from NPM (I mean without consequences)

github.com

Post reply on HN
Print view View original

61–70 of 122 posts

Re: You too can run malware from NPM (I mean without consequences)

#61

Post by diggan »

p2detar wrote: post #9

I’ve been out of the loop with npm for a while, but are there still no package namespaces?

Namespaces have existed since ~2016 at least in npm, but since it's not enforced and people want "nice looking" package names, the ecosystem still hasn't fully embraced it. It seems like more and more projects are using them (probably because all "good" names are already taken), but probably way less than half of all popular packages are scoped/namespaced.

Re: You too can run malware from NPM (I mean without consequences)

#62

Post by Cthulhu_ »

hiccuphippo wrote: post #28
clbrmbr wrote: post #13

Earlier quoted context omitted.

Huh. I read TFA in detail (and shared with my team), but I didn’t see any analysis. (?)

It seems to be this: https://intel.arkm.com/explorer/entity/61fbc095-f19b-479d-a0... 500 USD, not bad for a month of work if the author is from a 3rd world country.

"3rd world country" is an outdated cold war phrase usually incorrectly used to describe wealth or development status (it originally meant "anything not NATO or Warsaw Pact"); China is a third world country by that merit, but it's the second richest country (by GDP) in the world.

"Developing" or "poor" country may be a more accurate phrase.

Re: You too can run malware from NPM (I mean without consequences)

#63

Post by chrisweekly »

Cthulhu_ wrote: post #59
sesm wrote: post #5

Earlier quoted context omitted.

I think malware check should be opt-in for package authors, but provide some kind of 'verified' badge to the package. Edit: typo

I always thought this would be the ideal monetization path for NPM; enterprises pay them, NPM only supplies verified package releases, ideally delayed by hours/days after release so that anything that slips through the cracks has a chance to get caught.

Enterprises today typically use a custom registry, which can include any desired amount of scans and rigorous controls.

Re: You too can run malware from NPM (I mean without consequences)

#64

Post by EasyMark »

naugtur wrote: post #60
hn92726819 wrote: post #52

Earlier quoted context omitted.

I think most people are fine with promoting a cool project you work on, but it's best practice to disclose that in the article. Even something like "If your project was set up with LavaMoat (a project I've been working on), ..." would be enough. I think that's why they made the comment.

Yup, and thanks - I should have made the comment myself but got distracted.

You're forgiven. Thanks to you (and any other contribs) for the excellent project

Re: You too can run malware from NPM (I mean without consequences)

#65

Post by jamesnorden »

worthless-trash wrote: post #26
nodesocket wrote: post #15

Earlier quoted context omitted.

Or at a minimum support yubikey for 2fa.

Original author could be evil. 2fa does nothing.

If my grandma had wheels she'd be a bike. You don't need to attack the problem from only one angle.

Re: You too can run malware from NPM (I mean without consequences)

#66

Post by bavarianbob »

naugtur wrote: post #30
shreddit wrote: post #20

Earlier quoted context omitted.

“within hours” is at least one hour too late, and most likely multiple hours.

Absolutely not. you get npm packages by pulling not them pushing them to you as soon as a new version exist. The likelyhood of you updating instantly is close to zero and if not, you should set your stuff up so that it is. Many ways to do that. Even better if compared to a month or two - which is how long it often takes for a researcher to find a carefully planted malware. Anyway, the case where reactive tools (detec…

I've worked in software supply chain security for two years now and this is an extremely optimistic take. Nearly all organizations are not even remotely close to this level of responsiveness.

Re: You too can run malware from NPM (I mean without consequences)

#67

Post by yjftsjthsd-h »

sesm wrote: post #5
mohsen1 wrote: post #3

npm should take responsibility and up their game here. It’s possible to analyze the code and mark it as suspicious and delay the publish for stuff like this. It should prevent publishing code like this even if I have a gun to my head

I think malware check should be opt-in for package authors, but provide some kind of 'verified' badge to the package. Edit: typo

> but provide some kind of 'verified' badge to the package

I would worry that that results in a false sense of security. Even if the actual badge says "passes some heuristics that catch only the most obvious malicious code", many people will read "totally 100% safe, please use with reckless abandon".

Re: You too can run malware from NPM (I mean without consequences)

#68

Post by mcintyre1994 »

nodesocket wrote: post #15
mohsen1 wrote: post #3

npm should take responsibility and up their game here. It’s possible to analyze the code and mark it as suspicious and delay the publish for stuff like this. It should prevent publishing code like this even if I have a gun to my head

Or at a minimum support yubikey for 2fa.

They do, I use a yubikey and it requires me to authenticate with it whenever I publish. They do support weaker 2fa methods as well, but you can choose.
Post reply on HN