Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

github.com

Post reply on HN
Print view View original

61–70 of 296 posts

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#61

Post by stanac »

hiccuphippo wrote: post #52
IshKebab wrote: post #44

Earlier quoted context omitted.

Probably the differentiating factor here is that the phishing message was very plausible. Normally they're full of spelling mistakes and unprofessional grammar. The domain was also plausible. I think where they got lucky is > In hindsight, the fact that his browser did not auto-complete the login should have been a red flag. A huge red flag. I wonder if browsers should actually detect if you're putting login details…

My guess is their password manager is a separate app and they use the clipboard (or maybe it's a keyboard app) to paste the password. No way for the password manager to check the url in that case.

You are probably right. Still browser vendors or even extension devs can create a system where username hash and password hash are stored and checked on submit to warn for phishing. Not sure if I would trust such extension, except in case it's FF recommended and verified extension.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#62

Post by hfmuehleisen »

hfmuehleisen wrote: post #24
belgattitude wrote: post #22

Earlier quoted context omitted.

I think you should unpublish rather than deprecate... `npm unpublish package@version` ... It's possible within 72h. One reason is that the patched version contains -alpha... so tools like npm-check-updates would keep the 1.3.3 as the latest release for those who installed it

Yes we tried, but npm would not let us because of "dependencies". We've reached out to them and are waiting for a response. In the meantime, we re-published the packages with newer versions so people won't accidentally install the compromised version.

they have now removed the affected versions!

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#64

Post by stanac »

eviks wrote: post #38

> This website contained a *pixel-perfect copy* of the npmjs.com website. Not sure how this emphasis is of any importance, you brain doesn't have a pixel perfect image of the website, so you wouldn't know whether it's a perfect replica or not. Let the silicon dummies in the password manager do the matching, don't strain your brain with such games outside of entertainment

My password manager is a separate app, I always have to manually copy/paste the credentials. That's because I believed that approach to be more secure, now I see it's replacing one attack vector for another.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#65

Post by balder1991 »

herpdyderp wrote: post #58
ebfe1 wrote: post #19

Is it just me who think this could have been prevented if npm admins put in some sort of cool off period to only allow new versions or packages to be downloaded after being published by "x" amount of hours? This way the npm maintainer would get notifications on their email and react immediately? And if it is urgent fix, perhaps there can be a process to allow npm admin to approve and bypass publication cool off perio…

If I was forced to wait to download my own package updates I would simply stop using npm altogether and use something else.

It could be done like a rollout in % over time like app stores do.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#66

Post by mvieira38 »

r_lee wrote: post #36
skeeter2020 wrote: post #25

Earlier quoted context omitted.

>> So far, it seems to be a bog-standard phishing email The fact this is NOT the standard phishing email shows how low the bar is: 1. the text of the email reads like one you'd get from npm in the tone, format and lack of obvious spelling & grammatical errors. It pushes you to move quicker than you might normally, without triggering the typical suspicions. 2. the landing domain and website copy seem really close to l…

How does AI relate to this in any way? you can easily clone websites by just copying via devtools, like seriously same with just copying email HTML it's actually easier to make it looke exactly the same vs different in some ways

You can make your phishing bot write tailor-made messages and even respond

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#67

Post by eviks »

stanac wrote: post #64
eviks wrote: post #38

> This website contained a *pixel-perfect copy* of the npmjs.com website. Not sure how this emphasis is of any importance, you brain doesn't have a pixel perfect image of the website, so you wouldn't know whether it's a perfect replica or not. Let the silicon dummies in the password manager do the matching, don't strain your brain with such games outside of entertainment

My password manager is a separate app, I always have to manually copy/paste the credentials. That's because I believed that approach to be more secure, now I see it's replacing one attack vector for another.

What's the most common example of an alternative attack with autofill?

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#68

Post by tom1337 »

IshKebab wrote: post #44
diggan wrote: post #12

So far, it seems to be a bog-standard phishing email, with not much novelty or sophistication, seems the people running the operation got very lucky with their victims though. I'm starting to think we haven't even seen the full scope of it yet, two authors confirmed as compromised, must be 10+ out there we haven't heard of yet?

Probably the differentiating factor here is that the phishing message was very plausible. Normally they're full of spelling mistakes and unprofessional grammar. The domain was also plausible. I think where they got lucky is > In hindsight, the fact that his browser did not auto-complete the login should have been a red flag. A huge red flag. I wonder if browsers should actually detect if you're putting login details…

At least 1Password on iOS checks the URLs and if you use the extension to fill the password anyway you get a prompt informing you that you are filling onto a new url which is not associated with the login item.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#69

Post by hiccuphippo »

Maybe email software should add an option to make links unclickable, or show a box with the clear link (and highlight the domain) before letting the user go through it.

They already make links go through redirects (to avoid referrer headers?) so it's halfway there. Just make the redirect page show the link and a go button instead of redirecting automatically. And it would fix the annoyance that is not being able to see the real domain when you hover the link.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#70

Post by jve »

IshKebab wrote: post #44
diggan wrote: post #12

So far, it seems to be a bog-standard phishing email, with not much novelty or sophistication, seems the people running the operation got very lucky with their victims though. I'm starting to think we haven't even seen the full scope of it yet, two authors confirmed as compromised, must be 10+ out there we haven't heard of yet?

Probably the differentiating factor here is that the phishing message was very plausible. Normally they're full of spelling mistakes and unprofessional grammar. The domain was also plausible. I think where they got lucky is > In hindsight, the fact that his browser did not auto-complete the login should have been a red flag. A huge red flag. I wonder if browsers should actually detect if you're putting login details…

> Normally they're full of spelling mistakes and unprofessional grammar. The domain was also plausible.

I don't get these arguments. Yeah, of course I was always surprised phishing emails give itself away with mistakes as maybe non-native speakers create it without any spellcheck or whatever and it was straight forward to improve that... but whatever the text, if I open a link from email the first thing I look at is domain. Not how the site looks. The DOMAIN NAME! Am I on trusted site? Well .help TLD would SURELY ring a bell and involve research as whether this domain is associated to npm in any way.

At some point my bank redirected me to some weird domain name... meh, that was annoying, had to research whether that domain is really associated to them.. it was. But they just put their users under risk if they want domain name not to mean trust and just feed whatever domains as acceptable. That is NOT acceptable.

Post reply on HN