Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud Returns: Over 300 NPM Packages Infected

helixguard.ai

Post reply on HN
Print view View original

651–660 of 797 posts

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#651

Post by rco8786 »

amazingman wrote: post #485
LeifCarrotson wrote: post #454

Earlier quoted context omitted.

I think the issue is more about what else has to go into or be connected to that container. Posthog isn't really useful if it's air-gapped. You're going to give it keys to access all kinds of juicy databases and analytics, and those NPM tokens, AWS/GCP/Azure credentials, and environment variables are exactly what it exfiltrates. I don't run much on the root OS of my dev machine, basically everything is in a container…

Sure, but only the container is affected and it is always your responsibility to grant as little access as possible to the various credentials you may need to supply that environment. AFAICT with this worm, if you don't supply write-level GitHub credentials to the container (and you shouldn't!) and you install infected packages, the exploit goes no further.

> if you don't supply write-level GitHub credentials to the container (and you shouldn't!)

Really? What if your application needs to write to Github?

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#652

Post by windward »

ghurtado wrote: post #502
windward wrote: post #429

Earlier quoted context omitted.

In my experience Rust development is no slower than C development (in a different environment) or C++ development (in a comparable project)

I think they were using "writing Rust" in the most strict sense: the part of the development cycle that involves typing the majority of the code, before you really start debugging in earnest and really make things work. But their point is that "developing Rust" (as in, the entire process) ends up being a similar total effort to C, only with more up front "writing" and less work on the debugging phase.

And I'm saying it isn't any slower.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#653

Post by windward »

QuiEgo wrote: post #581
ghurtado wrote: post #502

Earlier quoted context omitted.

I think they were using "writing Rust" in the most strict sense: the part of the development cycle that involves typing the majority of the code, before you really start debugging in earnest and really make things work. But their point is that "developing Rust" (as in, the entire process) ends up being a similar total effort to C, only with more up front "writing" and less work on the debugging phase.

Thank you for the clarification, that's exactly what I was trying to say :). Perhaps another way to phrase this: in Rust, you spend more time telling the compiler how your code is expected to work (making the borrow checker happy, adding sync traits on objects you "know" are thread safe because of how you use them or assurances the underlying hardware provides, etc etc etc). In return, the compiler does a lot of work…

I don't spend significant time making the borrow checker happy, because I learned how to write C++ that works.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#655

Post by tasuki »

merelysounds wrote: post #350
tasuki wrote: post #334

Earlier quoted context omitted.

I don't get this explanation. How does it force you to run the infection code? Yes, if you depend on an infected package, sure. But then I'd expect not just a list, but a graph outlining which package infected which other package. Overall I don't understand this at all.

Look at the diff in the article, it shows the “inject” part: the malicious file is added to the “preinstall” attribute in the package.json.

I still don't get it. Like, I understand that if you apply the diff you get infected. But... why would you apply the diff? How would you trick me to apply that diff to my package?

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#656

Post by fennec-posix »

nathan_compton wrote: post #426

I never, ever, do development outside of a podman container these days. Basically if I am going to run some code from somewhere and I haven't read it, it goes in a container. I know its not foolproof, but I can't believe how often people run code they haven't read where it can make a huge mess, steal secrets, etc. I'll probably get owned someday, I'm sure, but this feels like a bare minimum.

Using Podman over Docker is probably an even safer bet in that regard. But QEMU or something for an extra layer of safety and paranoia is probably the next best thing.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#657

Post by ashishb »

jayknight wrote: post #648
ashishb wrote: post #625

Earlier quoted context omitted.

> I think it's better to not run npm as root user on container. I would suggest adding --user 1000 to your docker run command. Good point. Here's the improvement that work for me https://github.com/ashishb/dotfiles/commit/fe4fb15fe867bf77a...

It gets tricky with private dependencies, then you have to pass some sort of token into the container to authenticate with the host when installing dependencies.

Definitely.

Would you prefer doing those tricks or exposing everything on your machine to random npm packages?

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#658

Post by efortis »

thepill wrote: post #654

How do you test your projects if there are any infected/affected dependencies used? As i understand it could also be a dependency of a dependency ... that could be affected?

   npm audit
and

   npm audit --fix
Or if you want to know the version of a package you have installed:

   npm ls some-pkg

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#659

Post by whizzter »

dotancohen wrote: post #338
whizzter wrote: post #282

Earlier quoted context omitted.

Compared to the JS ecosystem and number of users both Python and Rust are puny, also the the NPM ecosystem also allowed by default for a lot of post-install actions since they wanted to enable a smooth experience with compiling and installing native modules (Not entirely sure how Cargo and PIP handles native library dependencies). As for Windows vs the other OS's, yes even the Windows NT family grew out of DOS and Wi…

This comment seems to address users intentionally installing malware. I mean to address cracking, the situation where an attacker gains root or installs software that the user does not know about. Preventing the user from installing something that they want to install is another issue completely. I'm hesitant to call it exactly security, though I agree that it falls under the auspices of security.

Cracking is a term related to removing copy-protections. Rooting or privilege escalation is better terms for what you're mentioning.

As for "users intentionally installing malware", Windows in the early 00s had a bunch of fundamentally insecure deployment models like ActiveX controls and browsers (IE especially) were more or less swiss cheese in terms of security even outside the ActiveX controls.

Visiting the wrong webpage was often enough to get crap on your computer.

My view is that once you have bad native code running on your computer there's a large chance that it's game-over (the modern sandboxes like WASM were designed to enforce a probably safe subset where regular kernel mistakes are shielded by another layer of abstraction that needs to be broken).

Even Linux has had privilege escalations every year as far as I know. Notarization/stores is just a way to try to keep check on what code runs on end-user computers that isn't sandboxed (and allow for revoking that code if found to be malicious), maybe Linux is slightly safer still but that's probably due to less older features in the Kernel, but Windows has for example recently gotten a rewritten font-parser in Rust (the previous font parser was a common exploitation point that was placed with a too high privilegie).

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#660

Post by whizzter »

skydhash wrote: post #298
whizzter wrote: post #282

Earlier quoted context omitted.

Compared to the JS ecosystem and number of users both Python and Rust are puny, also the the NPM ecosystem also allowed by default for a lot of post-install actions since they wanted to enable a smooth experience with compiling and installing native modules (Not entirely sure how Cargo and PIP handles native library dependencies). As for Windows vs the other OS's, yes even the Windows NT family grew out of DOS and Wi…

You can have security without having a walled garden. By trusting the user with the key of their own property.

You mean like the developers holding the npm-publishing keys that just allowed a worm to spread?
Post reply on HN