Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM debug and chalk packages compromised

aikido.dev

Post reply on HN
Print view View original

761–770 of 796 posts

Re: NPM debug and chalk packages compromised

#761

Post by hirako2000 »

kngspook wrote: post #754
graemep wrote: post #751

Earlier quoted context omitted.

Its a lot lower risk, its still not great IMO. Email is really not designed for it, and it trains people to use links to login.

Yeah, I hate these. It's also a very not-ergonomic was to sign in. I wish those companies would redirect those efforts to passkeys.

It's very ergonomic for those who discovered the internet via an iPhone, who think Gmail is email. They can't remember their passwords, and wouldn't know where how to recover most cryptographic factors. They have an email account they tend to have access to and use magic links to login , they are very happy with that.

Not promoting the pattern, I also find it worrying the majority of internet users have no basic understanding of authentication and the risk for their digital identity.

Re: NPM debug and chalk packages compromised

#762

Post by gslepak »

selfmodruntime wrote: post #653
gslepak wrote: post #287

Earlier quoted context omitted.

I do mean use Deno as the runtime. Details and examples of how to switch are here: https://crib.social/notice/AwQqG9gm365uat93Nw

How would this have prevented anything?

In this case it would not have prevented anything, but I never claimed that it would. Using Deno with appropriate sandboxing flags can protect developers against many classes of supply-chain attacks.

The reason it doesn't help in this instance is because the attack targets the generated bundle and runs on client devices, whereas other attacks will target developer machines themselves (and possibly also client devices). Those types of attacks can be mitigated by using Deno.

Re: NPM debug and chalk packages compromised

#763

Post by gslepak »

egorfine wrote: post #661
gslepak wrote: post #543

Earlier quoted context omitted.

> daily Somehow we've survived without updating dependencies for probably at least a year.

Then you probably have over a dozen CVEs in your code. Now, this is a different question whether they are exploitable and how much it is a risk. Other than that you now probably have an insurmountable technical debt and upgrading the dependencies is a project of itself. All the above applies to JavaScript world, of course. It's much different for the rest.

> Then you probably have over a dozen CVEs in your code.

We continuously monitor our dependencies for CVEs and update them if necessary. Most of the time the CVEs that are reported are not relevant / worth updating for.

Re: NPM debug and chalk packages compromised

#764

Post by rtpg »

zahlman wrote: post #706
rtpg wrote: post #517

Earlier quoted context omitted.

Was a bit surprised at this, but looking into the packages in a work project that require six, a _huge_ chunk of them are packages that are still explicitly supporting Python 2.7 still (usually stuff related to operations). I believe if you pay money to certain repo maintainers like red hat you can still have a supported version of Python 2.7.

> a _huge_ chunk of them are packages that are still explicitly supporting Python 2.7 still Do you know if they also support 3.x? Do you know if they're available on PyPI? > (usually stuff related to operations). What kind of "operations" do you mean?

yes they also support python 3.x, are available on PyPI, and are related to operations in the sense of like... infrastructure management and the like.

You have a huge pile of "sysop Python" out there interfacing with various infrastructure providers who are more interested in selling infra usage than getting off of Python 2.

"In order to use our new storage service via our library you need to upgrade to Python 3 first" "ehhhhhhhh kinda annoying"

That interaction has happened in the past. Time marches forward of course but.

Re: NPM debug and chalk packages compromised

#765

Post by idiotsecant »

lelanthran wrote: post #686
idiotsecant wrote: post #684

Earlier quoted context omitted.

If only they would have had the benefit of you being around to do all that work with your glorious hindsight.

> If only they would have had the benefit of you being around to do all that work with your glorious hindsight. They didn't need me; plenty of repositories doing signed packages existed well before npm was created. Which is why I likened them to a bunch of kids - they didn't look around at how the existing repos were designed, they just did the first thing that popped into their head.

On the other hand, they did the actual work when nobody else did. It's so easy to take potshots, when you've never done anything consequential enough for the results to matter as much as they do for npm.

Re: NPM debug and chalk packages compromised

#766

Post by rurban »

sflanagain wrote: post #360
pants2 wrote: post #324

Earlier quoted context omitted.

Almost certainly Lazarus

The phishing email comes across a bit too amateur. Specifically the inclusion of: "we kindly ask that you complete this update your earliest convenience". The email was included here: https://cdn.prod.website-files.com/642adcaf364024654c71df23/... From this article: https://www.aikido.dev/blog/npm-debug-and-chalk-packages-com...

Very amateur. Who would fall that, really? I can only suspect npm people who are used to unprofessional repo hosting practices.

Such a Two Factor Authentication update request would have needed a blog post first, to announce such a fishy request.

Re: NPM debug and chalk packages compromised

#767

Post by tbossanova »

vasco wrote: post #596
tbossanova wrote: post #523

Earlier quoted context omitted.

I see what you mean, but I actually think there is a place for copy/pasting AI responses. I think of it as a kind of cache, surely a HN comment being served to n users means less resources used and faster access than if all n did their own AI query. But then of course you don’t get exactly your preference e.g. you might prefer a terser response than what is pasted here. Interesting to see how the etiquette around thi…

If you ever wanted to share an AI response, you probably should share your prompt, not the response. But likely you should not share anything, for the reasons already explained. Your argument about saving energy makes zero sense if you have any understanding of orders of magnitude but I won't share what AI says about it.

Ironically you are being incredibly rude trying to support an argument that posting AI responses is rude. I guess we can conclude you know nothing about anything.

Re: NPM debug and chalk packages compromised

#768

Post by craftkiller »

paulddraper wrote: post #336
craftkiller wrote: post #67

Earlier quoted context omitted.

> You can pretend like this is unique to JS ecosystem, but xz was compromised for 3 years. Okay, but you're not suggesting that a compression algorithm is the same scale as "is-arrayish". I don't think everyone should need to reimplement LZMA but installing a library to determine if a value is an array is bordering on satire.

FWIW, is-arrayish is primarily an internal dependency. The author (Qix) depends on it for the packages that actually get used, liked color and error-ex. But it's all one author.

It might be an internal dependency for this author, but package.json is only for direct dependencies, right? github shows is-arrayish is a direct dependency of thousands of repos: https://github.com/search?q=%22is-arrayish%22+path%253Apacka...

Re: NPM debug and chalk packages compromised

#769

Post by danenania »

graemep wrote: post #751
hirako2000 wrote: post #743

Earlier quoted context omitted.

At least you've requested that email, to be able to login. The timing chance for a phishing mail to come here and there is insignificant. OP is referring to communications that are one way street, the (pseudo) organisation to you.

Its a lot lower risk, its still not great IMO. Email is really not designed for it, and it trains people to use links to login.

Username/password typically has the same issue via reset password links.

Re: NPM debug and chalk packages compromised

#770

Post by vasco »

tbossanova wrote: post #767
vasco wrote: post #596

Earlier quoted context omitted.

If you ever wanted to share an AI response, you probably should share your prompt, not the response. But likely you should not share anything, for the reasons already explained. Your argument about saving energy makes zero sense if you have any understanding of orders of magnitude but I won't share what AI says about it.

Ironically you are being incredibly rude trying to support an argument that posting AI responses is rude. I guess we can conclude you know nothing about anything.

I never mention rudeness, I dont give a shit about random people online being "rude". It's just something I don't like, so I shared my opinion.
Post reply on HN