Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Axios compromised on NPM – Malicious versions drop remote access trojan

stepsecurity.io

Post reply on HN
Print view View original

661–670 of 894 posts

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#661

Post by charcircuit »

hu3 wrote: post #400
charcircuit wrote: post #310

Earlier quoted context omitted.

Take for example iOS and Android. All apps are sandboxed by default. You can't make a program that just steals all of your credentials like you can on desktop Linux. Having security tools means nothing if they aren't being used.

No one is running npm in Android or iOS. A more apt comparison is vs Windows and macOS. And Linux offer more than these two with regards to security.

They aren't because Node haven't developed a Node app for them. Desktop Linux does not offer more security than macOS. macOS has proper security around stuff like apps using the mic and camera.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#662

Post by commandlinefan »

bob1029 wrote: post #241

"Batteries included" ecosystems are the only persistent solution to the package manager problem. If your first party tooling contains all the functionality you typically need, it's possible you can be productive with zero 3rd party dependencies. In practice you will tend to have a few, but you won't be vendoring out critical things like HTTP, TCP, JSON, string sanitation, cryptography. These are beacons for attackers…

> "Batteries included" ecosystems are the only persistent solution

Or write your own stuff. Yes, that's right, I said it. Even HTTP. Even cryptography. Just because somebody else messed it up once doesn't mean nobody should ever do it. Professional quality software _should_ be customized. Professional developers absolutely can and should do this and get it right. When you use a third-party HTTP implementation (for example), you're invariably importing more functionality than you need anyway. If you're just querying a REST service, you don't need MIME encoding, but it's part of the HTTP library anyway because some clients do need it. That library (that imports all of its own libraries) is just unnecessary bloat, and this stuff really isn't that hard to get right.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#663

Post by charcircuit »

PunchyHamster wrote: post #403
charcircuit wrote: post #310

Earlier quoted context omitted.

Take for example iOS and Android. All apps are sandboxed by default. You can't make a program that just steals all of your credentials like you can on desktop Linux. Having security tools means nothing if they aren't being used.

Android is running Linux...

And they added a lot of code to make it safe for users to install and use apps in general.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#664

Post by habinero »

themafia wrote: post #71
ArcHound wrote: post #43

Earlier quoted context omitted.

Hi, security here. We've tried, but the amount of people you need for this vs the amount of people you have trying to review and click the big button always means that this step will be a bottleneck. Thus this step will be eliminated. A much better approach would be to pin the versions used and do intentional updates some time after release, say a sprint after.

Why not just release escrow? If I try to push a new release version another developer or developers have to agree to that release. In larger projects you would expect the release to be coordinated or scheduled anyways. Effectively we're just moving "version pinning" or "version delay" one layer up the release chain.

A lot of libraries are maintained by a single person.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#665

Post by erikerikson »

moebrowne wrote: post #627
erikerikson wrote: post #499

Earlier quoted context omitted.

Instead they took away TOTP as a factor. Scaling security with the popularity of a repo does seem like a good idea.

TOTP isn't phishing resistant

No it's not but it's better than nothing. Don't let the perfect be the enemy of the good.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#666

Post by erikerikson »

mayhemducks wrote: post #614
erikerikson wrote: post #499

Earlier quoted context omitted.

Instead they took away TOTP as a factor. Scaling security with the popularity of a repo does seem like a good idea.

Are there downsides to doing this? This was my first thought - though I also recognize that first thoughts are often naive.

TOTP although venerable was better than no second factor at all.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#667

Post by Willish42 »

> This was not opportunistic. It was precision. The malicious dependency was staged 18 hours in advance.

Another obvious ChatGPT-ism. The fact that people are using AI to write these security posts doesn't surprise me, but the fact they use it to write a verbose article with spicy little snippets that LLMs seem to prefer does make it really hard to appreciate anything other than the simple facts in the article.

Yet another case in point for "do your own writing" (https://news.ycombinator.com/item?id=47573519)

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#668

Post by nailer »

bbkane wrote: post #589
nailer wrote: post #572

Earlier quoted context omitted.

> at least making the default much better by asking you every time they want to do something Really? I thought 'asking you every time they want to do something' was called 'security fatigue' and generally considered to be a bad thing. Yes you can concatenate files in the current project, Claude.

Yes it has to be combined with a robust way to allowlist actions you trust

Oddly, since I wrote that Claude 'auto' mode just landed and I built something with it (instead of 'dangeously skip') and it's working.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#669

Post by sbarre »

woodruffw wrote: post #441
sbarre wrote: post #433

Earlier quoted context omitted.

This is what tripped me up. I added that config and then got this error: error: Failed to parse: `.config/uv/uv.toml` Caused by: TOML parse error at line 1, column 17 | 1 | exclude-newer = "7 days" | ^^^^^^^^ failed to parse year in date "7 days": failed to parse "7 da" as year (a four digit integer): invalid digit, expected 0-9 but got I was on version 0.7.20, so I removed that line, ran "uv self update" and upgrade…

Yeah, that error message isn’t ideal on older versions, but unfortunately there’s no way to really address that. But I’m glad it’s working for you on newer versions.

For what it's worth the error made sense enough to me that I figured I needed to upgrade. :-)

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#670

Post by junon »

dboreham wrote: post #619
junon wrote: post #264

Earlier quoted context omitted.

Because fat std is rigid, impractical, and annoying.

I think we found the constituency that led to the present sorry situation.

That's rather rude.

If you're referring to my packages on npm, I joined way late to that game. This was also ~15 years ago.

Post reply on HN