Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

socket.dev

Post reply on HN
Print view View original

781–790 of 1001 posts

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#781

Post by oneshtein »

weinzierl wrote: post #137
Meneth wrote: post #91

This happens because there's no auditing of new packages or versions. The distro's maintainer and the developer is the same person. The general solution is to do what Debian does. Keep a stable distro where new packages aren't added and versions change rarely (security updates and bugfixes only, no new functionality). This is what most people use. Keep a testing/unstable distro where new packages and new versions can…

In Rust we have cargo vet, where we share these audits and use them in an automated fashion. Companies like Google and Mozilla contribute their audits.

How to backport security fixes to vetted packages?

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#782

Post by sfn42 »

joquarky wrote: post #770
sfn42 wrote: post #168

Earlier quoted context omitted.

I was hyped for wasm because i thought it was supposed to solve this problem, allowing any programming language to be compiled to run in browsers. But apparently they only made it do like 95% of what JS does so you can't actually replace js with it. To me it seems like a huge blunder. I don't give a crap about making niche applications a bit faster, but freeing the web from the curse of JS would be absolutely huge. A…

The DOM is fundamentally dependent upon JS shaped data structures and garbage collection. They are BFFs. Any attempt to bypass this will be perilous.

So we'd need a new DOM, seems feasible

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#783

Post by zwnow »

what wrote: post #738
Ygg2 wrote: post #670

Earlier quoted context omitted.

Yeah. You have dev dependencies in there, those alone will increase number of dependencies by ~500, without ending up in the final product. Those numbers are way off their actual number.

500 dev dependencies doesn’t seem reasonable either…

Even 50 seems unreasonable...

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#785

Post by baq »

_puk wrote: post #544
jay_kyburz wrote: post #535

Earlier quoted context omitted.

Yes, fewer, larger, trustworthy dependencies with tree shaking is the way to go if you ask me.

Almost like a standard library..

I wanted to make a joke about

   npm install stdlib
…but double checked before and @stdlib/stdlib has 58 dependencies, so the joke preempted me.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#786

Post by baq »

vFunct wrote: post #724
zelphirkalt wrote: post #457

Earlier quoted context omitted.

Most dependencies do much more than we need from them. Often it means we only need one or a few functions from them. This means one doesn't need to rewrite whole dependencies usually. Don't use dependencies for things you can trivially write yourself, and use them for cases where it would be too much work to write yourself.

I'm using LLMs to write stuff that would normally be in dependencies, mostly because I don't want to learn how to use the dependency, and writing a new one from scratch is really easy with LLMs.

Age of bespoke software is here. Did you have any hard to spot non-obvious bugs in these code units?

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#787

Post by whilenot-dev »

aorth wrote: post #759

In the story about the Nx compromise a few weeks ago someone posted a neat script that uses bubblewrap on Linux to run tools like npm more safely by confining their filesystem access. https://news.ycombinator.com/item?id=45034496 I modified the script slightly based on some of the comments in the thread and my own usage patterns: #!/usr/bin/env bash # # See: https://news.ycombinator.com/item?id=45034496 bin=$(basenam…

> --bind "${PWD}" "${PWD}"

Pardon my ignorance, but couldn't a malicious actor just redefine $PWD before calling a npm script?

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#788

Post by ncruces »

Ygg2 wrote: post #670
ncruces wrote: post #511

Earlier quoted context omitted.

Just the other day someone argued with me that it was reasonable for Limbo (the SQLite Rust rewrite) to have 3135 dependencies (of those, 1313 Rust dependencies). https://github.com/tursodatabase/turso/network/dependencies

Yeah. You have dev dependencies in there, those alone will increase number of dependencies by ~500, without ending up in the final product. Those numbers are way off their actual number.

Right. Allowing 500 strangers to push code to our CI infra, or developer laptops, with approximately zero review, sounds similarly ill advised.

That JLR got their factories hacked, rather than customer cars, is less bad for sure. But it's still pretty bad.

Also, before arguing that code generators should get a pass as they don't “end up in the final product”, you really should read “Reflections on trusting trust” by Ken Thompson.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#789

Post by catlifeonmars »

kelnos wrote: post #405

As a user of npm-hosted packages in my own projects, I'm not really sure what to do to protect myself. It's not feasible for me to audit every single one of my dependencies, and every one of my dependencies' dependencies, and so on. Even if I had the time to do that, I'm not a typescript/javascript expert, and I'm certain there are a lot of obfuscated things that an attacker could do that I wouldn't realize was embed…

I think it definitely couldn’t hurt. You’re right it doesn’t eliminate the threat of supply chain attacks, but it would certainly reduce them and wouldn’t require much effort to implement (either manually or via script). You’re basically giving maintainers and researchers time to identify new malware and patch or unrelease them before you’re exposed. Just make sure you still take security patches.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#790

Post by Eisenstein »

respondo2134 wrote: post #599
TZubiri wrote: post #574

Earlier quoted context omitted.

There's this defense mechanism that I don't know how it's called, but when someone takes a criticism to the extreme to complain about it being unfeasible. Criticism: "You should shower every day" Defense: "OH, maybe I should shower every hour, to the point where my skin dries and I can't get my work done because I'm in the shower all day." No, there's a pretty standard way of doing things that you can care to learn,…

Reductio ad Absurdum may be what you're thinking of, but Straw Man might also apply. Funny enough the responder didn't actually do what you said. They stated of the 600+ dependencies they counted there was only one they felt comfortable implementing themselves. Your accusation of them taking your statement to the extreme is reverse straw man rhetoric; you're misrepresenting their argument as extreme or absurd when it…

Reductio ad Absurdum is not a fallacy but a legitimate rhetorical technique where you can point out obvious flaws in logic by taking that logic and applying it to something that people would find ridiculous. Note that this is not the most 'extreme' version, it is the same version, using the same logic.

Example:

Argument: People should be able to build whatever they want on their own property.

Reductio ad Absurdum position: I propose to build the world's largest Jenga tower next to your house.

Note that this does not take into account any counter arguments such as 'if it falls on me you will still be liable for negligence', but it makes a point without violating the logic of the original argument. To violate that logic would indeed be a straw man.

Post reply on HN