Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

socket.dev

Post reply on HN
Print view View original

621–630 of 1001 posts

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#621

Post by dmitrygr »

SkiFire13 wrote: post #219
Meneth wrote: post #91

This happens because there's no auditing of new packages or versions. The distro's maintainer and the developer is the same person. The general solution is to do what Debian does. Keep a stable distro where new packages aren't added and versions change rarely (security updates and bugfixes only, no new functionality). This is what most people use. Keep a testing/unstable distro where new packages and new versions can…

> Keep a stable distro where new packages aren't added and versions change rarely (security updates and bugfixes only, no new functionality). This is what most people use. Unfortunately most people don't want old software that doesn't support newer hardware so most people don't end up using Debian stable.

> Unfortunately most people don't want old software

"old" is a strange way to spell "new, unstable, and wormed".

I want old software. Very little new features are added to most things i care about, mostly it is just bloat, AI slop, and monthly subscription shakedowns being added to software today.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#622

Post by collinmanderson »

homebrewer wrote: post #555
kelnos wrote: post #405

As a user of npm-hosted packages in my own projects, I'm not really sure what to do to protect myself. It's not feasible for me to audit every single one of my dependencies, and every one of my dependencies' dependencies, and so on. Even if I had the time to do that, I'm not a typescript/javascript expert, and I'm certain there are a lot of obfuscated things that an attacker could do that I wouldn't realize was embed…

Don't update your dependencies manually. Setup renovate to do it for you, with a delay of at least a couple of weeks, and enable vulnerability alerts so that it opens PRs for publicly known vulnerabilities without delay https://docs.renovatebot.com/configuration-options/#minimumr... https://docs.renovatebot.com/presets-default/#enablevulnerab...

Why was this comment downvoted? Please explain why you disagree.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#623

Post by 1over137 »

kelnos wrote: post #405

As a user of npm-hosted packages in my own projects, I'm not really sure what to do to protect myself. It's not feasible for me to audit every single one of my dependencies, and every one of my dependencies' dependencies, and so on. Even if I had the time to do that, I'm not a typescript/javascript expert, and I'm certain there are a lot of obfuscated things that an attacker could do that I wouldn't realize was embed…

>It's not feasible for me to audit every single one of my dependencies

Perhaps I’m just ignorant of web development, but why not? We do so with our desktop software.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#624

Post by jkrems »

ojosilva wrote: post #619
spion wrote: post #486

Earlier quoted context omitted.

pnpm just added minimum age for dependencies https://pnpm.io/blog/releases/10.16#new-setting-for-delayed-...

From your link: > In most cases, such attacks are discovered quickly and the malicious versions are removed from the registry within an hour. By delaying the infected package availability (by "aging" dependencies), we're only delaying the time, and reducing samples, until it's detected. Infections that lay dormant are even more dangerous than explosives ones. The only benefit would be if, during this freeze, reposito…

Afaict many of these recent supply chain attacks _have_ been detected by scanners. Which ones flew under the radar for an extended period of time?

From what I can tell, even a few hours of delay for actually pulling dependencies post-publication to give security tools a chance to find it would have stopped all (?) recent attacks in their tracks.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#625

Post by collinmanderson »

torben-friis wrote: post #122

I think these kinds of attack would be strongly reduced if js had a strong standard library. If it was provided, it would significantly trim dependency trees of all the small utility libraries. Perhaps we need a common community effort to create a “distro” of curated and safe dependencies one can install safely, by analyzing the most popular packages and checking what’s common and small enough to be worth being inclu…

> Perhaps we need a common community effort to create a “distro” of curated and safe dependencies one can install safely, by analyzing the most popular packages and checking what’s common and small enough to be worth being included/forked.

Debian is a common community effort to create a “distro” of curated and safe dependencies one can install safely.

If you want stable, tested versions of software, only getting new versions every few years:

https://packages.debian.org/stable/javascript/

If you want the newer versions of software, less tested, getting new versions continuously:

https://packages.debian.org/unstable/javascript/

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#626

Post by com2kid »

lenerdenator wrote: post #315
jeswin wrote: post #167

Earlier quoted context omitted.

Traditional JS is actually among the safest environments ever created. Every day, billions of devices run untrusted JS code, and no other platform has seen sandboxed execution at such scale. And in nearly three decades, there have been very few incidents of large successful attacks on browser engines. That makes the JS engine derived from browsers the perfect tool to build a server side framework out of. However, pro…

> Traditional JS is actually among the safest environments ever created. > However, processes and practices around NodeJS and npm are in dire need of a security overhaul. leftpad is a cultural problem that needs to be addressed. To start with, snippets don't need to be on npm. Traditional JS is the reason we have all of these problems around NodeJS and npm. It's a lot better than it was, but a lot of JS tooling came…

Python is the other extreme, with an incredibly heavy weight standard library with a built in function to do just about anything.

E.g. there is a built in function that takes elements pairwise from a list! That level of minutia being included feels nuts having come from other languages.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#627

Post by hacker_homie »

I’m not sure language package mangers were a good idea at all. Dependencies were supposed to be painful. If the language needed some functionality built in it was supposed to go into the standard library, I understand that for JS this isn’t feasible.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#628

Post by oefrha »

spion wrote: post #486
kelnos wrote: post #405

As a user of npm-hosted packages in my own projects, I'm not really sure what to do to protect myself. It's not feasible for me to audit every single one of my dependencies, and every one of my dependencies' dependencies, and so on. Even if I had the time to do that, I'm not a typescript/javascript expert, and I'm certain there are a lot of obfuscated things that an attacker could do that I wouldn't realize was embed…

pnpm just added minimum age for dependencies https://pnpm.io/blog/releases/10.16#new-setting-for-delayed-...

Thank god, adopting this immediately. Next I’d like to see Go-style minimum version selection instead.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#629

Post by keyle »

zachrip wrote: post #119
lithos wrote: post #83

Earlier quoted context omitted.

Just more engineering leaning than you. Actual engineers have to analyze their supply chains, and so makes sense they would be baffled by NPM dependency trees that utterly normal projects grow into in the JavaScript ecosystem.

Do you think companies using node don't analyze supply chains? That's nonsense. Have you cargo installed a rust app recently? This isn't just a js issue. This needs to be solved across the industry and npm frankly has done a horrible job at it. We let people with billions of downloads a month with recently changed password/2fa publish packages? Why don't we pool assets as a collective to scan newly published packages…

2FA would certainly help, however you'd still have malware like these silently updating code and waiting for the next release.

We'd have to rely on the developer to notice, and check every line of code they ship, which might be the norm but certainly not 100% of cases.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#630

Post by keyle »

indigodaddy wrote: post #390

Ironically I started seeing a message in GitHub saying 2fa will be auto-enforced shortly. Wonder if that is a sign of similar for npm packaging? Or wonder if GitHub is enforcing 2fa soon because of the NPM CVEs potential to harvest GitHub creds?

2FA is the first steps is stopping the onslaught.

But it still doesn't stop infected developer machines to silently update code and wait for the next release patiently.

It would require the diligence of those developers to check every line of code that goes out with a release... which is a lot to ask for someone who fell for a fishing email.

Post reply on HN