Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud Returns: Over 300 NPM Packages Infected

helixguard.ai

Post reply on HN
Print view View original

791–797 of 797 posts

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#791

Post by pmontra »

xp84 wrote: post #721
cyanydeez wrote: post #633

Earlier quoted context omitted.

Ignorance. Most programmers in open source operate on the "works on my machine"

True, and things that manifest only on old/slow hardware or on bad internet are the worst kind for this, since 100% of developers who have any say in the matter would never accept such circumstances at all, so they’re always approaching every issue with multi-gigabit speeds, zero latency, and this year’s $3,000 Mac. “What do you mean the page loads slowly?”

A customer of mine has the implementation of several API endpoints starting with a simulate_slow_connection method that basically sleeps for a random amount of ms. I think it sleeps 0 ms when running tests and definitely sleeps 0 ms in production. So it's never super fast even on $3,000 Macs.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#792

Post by tapete2 »

bpavuk wrote: post #548
embedding-shape wrote: post #513

Earlier quoted context omitted.

> NPM is too insecure for production CLI usage. NPM was never "too insecure" and remains not "too insecure" today. This is not an issue with npm, JavaScript, NodeJS, the NodeJS foundation or anything else but the consumer of these libraries pulling in code from 3rd parties and pushing it to production environments without a single review. How this still fly today, and have been since the inception of public "easy to…

wait, I short-circuited here. wasn't the very concept of "libraries" created to *not* have to think about what exactly the code does? imagine reviewing every React update. yes, some do that (Obsidian claims to review every dependency, whether new or an update), but that's due to flaws of the ecosystem. take a look at Maven Central. it's harder to get into, but that's the price of security. you have to verify the name…

> wasn't the very concept of "libraries" created to not have to think about what exactly the code does?

Let's say you need a FFT implementation. You can write that from scratch, or you can use a library. In both cases you should use tests to verify that the code calculates the FFT correctly, and in the library case you should read the code to make sure that it works correctly and does not omit and edge cases (e.g.).

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#793

Post by timeon »

alextingle wrote: post #784
iknowstuff wrote: post #587

Earlier quoted context omitted.

You don't know that about a C project. And you still don't know what lurks in its 1000th reimplementation of http header parsing.

Well, yes I do know when a C project only depends on my system libraries, because otherwise it won't compile. That's the point. Furthermore, for the purposes of this discussion, it really doesn't matter what code there is in the C project. What's there has been put there by the people who run the project. If they are malicious, then at least I know who they are. With Rust, I'm downloading and compiling code from many…

You do not know if developers are malicious when there are many contributors.

Now we are talking about NPM other time about: https://en.wikipedia.org/wiki/XZ_Utils_backdoor

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#795

Post by bpavuk »

Ajedi32 wrote: post #647
bpavuk wrote: post #548

Earlier quoted context omitted.

wait, I short-circuited here. wasn't the very concept of "libraries" created to *not* have to think about what exactly the code does? imagine reviewing every React update. yes, some do that (Obsidian claims to review every dependency, whether new or an update), but that's due to flaws of the ecosystem. take a look at Maven Central. it's harder to get into, but that's the price of security. you have to verify the name…

Are GitHub creds any harder for malware to steal than NPM creds? I don't see how that helps at all.

well, if you talk about private SSH keys for Git operations and SSH/GPG keys for signing, then you'd better set up a passphrase on them, which GitHub strongly recommends. the passphrase will make it significantly harder to use the keys. so, as usual, It Depends (c)

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#796

Post by bpavuk »

JodieBenitez wrote: post #624
tadfisher wrote: post #583

Earlier quoted context omitted.

> Go is also nice in that regard - you are depending on Git repositories directly, so you have to hijack into the Git repo permissions and spoil the source code there. That in itself is scary because Git refs are mutable. Even with compromised credentials, no one can replace artifacts already deployed to Maven Central, because they simply don't allow it. There is nothing stopping someone from replacing a Git tag with…

I don't know if it's a common or even a good practice, but I like to go mod vendor and add the result to my repo.

I do `cargo vendor` sometimes, but that's mostly to enable offline work and use the debugger inside some vague crates (Rust's libraries-but-not-really), and usually I gitignore the `vendor`'ed crates away.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#797

Post by gooob »

das_keyboard wrote: post #256

Slightly OT, but who is HelixGuard? The website is a mess (broken links, broken UI elements, no about section) There is no history on webarchive. There is no information outside of this website and their "customers" are crypto exchanges and some japanese payment provider. This seems a bit fishy to me - or am I too paranoid?

same thing i was thinking lol
Post reply on HN