Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM debug and chalk packages compromised

aikido.dev

Post reply on HN
Print view View original

651–660 of 796 posts

Re: NPM debug and chalk packages compromised

#651

Post by junon »

herpdyderp wrote: post #539
junon wrote: post #398

Earlier quoted context omitted.

Hi, missing a lot of history here. When Chalk was written, colors in the terminal wasn't a flashy thing people tried to do very often, at least not in the JS world. Coming from browsers and wanting to make CLI apps using the flashy new Node.js 0.10/0.12 at the time saw a lot of designers and other aesthetically-oriented folks with it. Chalk filled a hole for people to do that without needing to understand how TTYs wo…

> Node.js proper has floated the idea of including chalk into the standard libraries, FWIW. Oh my word please no! Every time I run into an issue where a dependency suddenly isn’t logging colors like it’s supposed to, it always boils down to chalk trying to do something fancy to handle an edge case that doesn’t actually exist. Just log the dang colors!

I'd be curious what those edge cases are, as a maintainer of chalk.

Re: NPM debug and chalk packages compromised

#652

Post by junon »

svendroevskaeg wrote: post #625
junon wrote: post #9

Hi, yep I got pwned. Sorry everyone, very embarrassing. More info: - https://github.com/chalk/chalk/issues/656 - https://github.com/debug-js/debug/issues/1005#issuecomment-3... Affected packages (at least the ones I know of): - ansi-styles@6.2.2 - debug@4.4.2 (appears to have been yanked as of 8 Sep 18:09 CEST) - chalk@5.6.1 - supports-color@10.2.1 - strip-ansi@7.1.1 - ansi-regex@6.2.1 - wrap-ansi@9.0.1 - color-conve…

So by "Just NPM is affected" does that mean yarn is unaffected?

No, anything that connects to npm as an authoritative source for packages. Yarn, pnpm, and npm clients all do.

Re: NPM debug and chalk packages compromised

#653

Post by selfmodruntime »

gslepak wrote: post #287
butshouldyou wrote: post #272

Earlier quoted context omitted.

Can you expand on "use Deno" for installing dependencies? I assume you don't mean to use Deno as the runtime, just for dependency management.

I do mean use Deno as the runtime. Details and examples of how to switch are here: https://crib.social/notice/AwQqG9gm365uat93Nw

How would this have prevented anything?

Re: NPM debug and chalk packages compromised

#654

Post by Macha »

sunaookami wrote: post #582
withinboredom wrote: post #192

Earlier quoted context omitted.

> I'd probably go looking for a new password manager if it fails to do one of the basic features they exist for, copy-pasting passwords defeats a lot of the purpose :) This isn’t the fault of the password managers themselves, but devs not putting the right metadata on their login forms, or havo the password field show only after putting in the email address, causing the password input to fail to be filled, etc.

Then get a good password manager that matches the domain and triple-check if it's a new domain. If your password manager shows you your npm login for npmjs.com and you are suddenly on a new domain and your password manager doesn't show logins, you will notice.

I've noticed failure to fill the right fields (or any fields) on Lastpass, 1Password, Bitwarden and the KeepassXC browser extension.

What is your mythical "good password manager"?

Re: NPM debug and chalk packages compromised

#655

Post by Macha »

Spivak wrote: post #390
__MatrixMan__ wrote: post #380

Earlier quoted context omitted.

We should be displaying hashes in a color scheme determined by the hash (foreground/background colors for each character determined by a hash of the hash, salted by that character's index, adjusted to ensure sufficient contrast). That way it's much harder to make one hash look like another.

Not sure why you're being downvoted, OpenSSH implemented randomart which gives you a little ascii "picture" of your key to make it easier for humans to validate. I have no idea if your scheme for producing keyart would work but it sounds like it would make a color "barcode".

I have to say the openssh random art has never really helped for me - I see each individual example so infrequently and there's so little detail to remember that it may as well just be a hash for all the memorability it doesn't add

Re: NPM debug and chalk packages compromised

#656

Post by txdv »

PokestarFan wrote: post #174
cddotdotslash wrote: post #154

NPM deserves some blame here, IMO. Countless third party intel feeds and security startups can apparently detect this malicious activity, yet NPM, the single source of truth for these packages, with access to literally every data event and security signal, can't seem to stop falling victim to this type of attack? It's practically willful ignorance at this point.

NPM is owned by GitHub and therefore Microsoft, who is too busy putting in Copilot into apps that have 0 reason to have any form of generative AI in them

Just write a check.md instruction for copilot to check it for malicious acticity, problem solved

Re: NPM debug and chalk packages compromised

#657

Post by alper »

junon wrote: post #141
zachleat wrote: post #132

Earlier quoted context omitted.

Yo, someone at npm needs to unpublish simple-swizzle@0.2.3 IMMEDIATELY. It’s still actively compromised.

It's been almost two hours without a single email back from npm. I am sitting here struggling to figure out what to do to fix any of this. The packages that have Sindre as a co-publisher have been published over but even he isn't able to yank the malicious versions AFAIU. If there's any ideas on what I should be doing, I'm all ears. EDIT: I've heard back, they said they're aware and are on it, but no further details.

NPM is a Github company and when there was a relatively serious attack in Github Actions a while back there was also pretty much zero response from them.

Github is SOC2 compliant, but that of course means nothing really.

Re: NPM debug and chalk packages compromised

#658

Post by [deleted] »

b112 wrote: post #636
zarzavat wrote: post #630

Earlier quoted context omitted.

There's actually nothing the developers can do about this particular issue other than to display all colors and allow colorblind people to see the colors that they can see.

For the newly made up feature, which doesn't exist yet, but already has an issue? Simple. Instead of forcing colour, one could retain a no colour option maybe? Done. Solved. Everything should have this option. I personally have no colour vision issues, other than I find colour annoying in any output. There's a lot who prefer this too.

[deleted]

Re: NPM debug and chalk packages compromised

#659

Post by gblargg »

AaronAPU wrote: post #460
9dev wrote: post #442

Earlier quoted context omitted.

As someone with red/green vision deficiency: if you do this, please don’t forget people like me are unable to distinguish many shades of colours, which would be very disadvantageous here!

It’s not like it would hurt you for there to be supplementary info others can see but you can’t.

I think 9dev was saying that providing only a colorized version might make it unreadable to some people, not merely that they wouldn't benefit from the extra color information.

Re: NPM debug and chalk packages compromised

#660

Post by jasode »

sneak wrote: post #646
junon wrote: post #473

Earlier quoted context omitted.

I use a password manager. I was mobile, the autofill stuff isn't installed as I don't use it often on my phone. In 15 years of maintaining OSS, I've never been pwned, phished, or anything of the sort. Thank you for your input :)

I never copy and paste passwords. Any time you find yourself wanting to do that, alarm bells should be ringing. Password managers can’t help you if you don’t use them properly. Spotify steals (and presumably uploads) your clipboard, as well as other apps. Autofill is your primary defense against phishing, as you (and hopefully some others) learned this week.

>Autofill is your primary defense against phishing,

The autofill feature is not 100% reliable for various reasons:

(1) some companies use different domains that are legitimate but don't exactly match the url in the password manager. Troy Hunt, the security expert who runs https://haveibeenpwned.com/ got tricked because he knew autofill is often blank because of legit different domains[1]. His sophisticated knowledge and heuristics of how autofill is implemented -- actually worked against him.

(2) autofill doesn't work because of technical bugs in the plugin, HTML elements detection, interaction/incompatibility with new browser versions, etc. It's a common complaint with all password plugins:

https://www.google.com/search?q=1password+autofill+doesn%27t...

https://www.1password.community/discussions/1password/1passw...

https://github.com/bitwarden/clients/issues?q=is%3Aissue%20a...

... so in the meantime while the autofill is broken, people have to manually copy-paste the password!

The real-world experience of flaky and glitchy autofill distorts the mental decision tree.

Instead of, "hey, the password manager didn't autofill my username/password?!? What's going on--OH SHIT--I'm being phished!" ... it becomes "it didn't autofill in the password (again) so I assume the Rube-Goldberg contraption of pw manager browser plugin + browser version is broken again."

Consider the irony of how password managers not being perfectly reliable causes sophisticated technical minds to become susceptible to social engineering.

In other words, password managers inadvertently create a "Normalization of Deviance" : https://en.wikipedia.org/wiki/Normalization_of_deviance

[1] >Thirdly, the thing that should have saved my bacon was the credentials not auto-filling from 1Password, so why didn't I stop there? Because that's not unusual. There are so many services where you've registered on one domain (and that address is stored in 1Password), then you legitimately log on to a different domain. -- from: https://www.troyhunt.com/a-sneaky-phish-just-grabbed-my-mail...

Post reply on HN