Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

github.com

Post reply on HN
Print view View original

81–90 of 296 posts

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#81

Post by welder »

stanac wrote: post #64
eviks wrote: post #38

> This website contained a *pixel-perfect copy* of the npmjs.com website. Not sure how this emphasis is of any importance, you brain doesn't have a pixel perfect image of the website, so you wouldn't know whether it's a perfect replica or not. Let the silicon dummies in the password manager do the matching, don't strain your brain with such games outside of entertainment

My password manager is a separate app, I always have to manually copy/paste the credentials. That's because I believed that approach to be more secure, now I see it's replacing one attack vector for another.

Please change that now! It's the muscle memory of never typing a password that prevents you from being victim to phishing.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#82

Post by 400thecat »

jve wrote: post #70
IshKebab wrote: post #44

Earlier quoted context omitted.

Probably the differentiating factor here is that the phishing message was very plausible. Normally they're full of spelling mistakes and unprofessional grammar. The domain was also plausible. I think where they got lucky is > In hindsight, the fact that his browser did not auto-complete the login should have been a red flag. A huge red flag. I wonder if browsers should actually detect if you're putting login details…

> Normally they're full of spelling mistakes and unprofessional grammar. The domain was also plausible. I don't get these arguments. Yeah, of course I was always surprised phishing emails give itself away with mistakes as maybe non-native speakers create it without any spellcheck or whatever and it was straight forward to improve that... but whatever the text, if I open a link from email the first thing I look at is…

more alarming than .help domain is the domain registration just few weeks ago. I got scammed just last week when paying with credit card online, and only later when investigating discovered several of identical eshops with different .shop domains registered just months ago if domain is less that year old, it should raise red flags

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#83

Post by hu3 »

ljlolel wrote: post #47
koakuma-chan wrote: post #33

Earlier quoted context omitted.

Npm can't force people to use password manager

You can if you just force passwords longer than people can memorize or even want to write down (assigned 24+ characters)

careless people just copy paste those

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#84

Post by 400thecat »

bluGill wrote: post #73
jve wrote: post #70

Earlier quoted context omitted.

> Normally they're full of spelling mistakes and unprofessional grammar. The domain was also plausible. I don't get these arguments. Yeah, of course I was always surprised phishing emails give itself away with mistakes as maybe non-native speakers create it without any spellcheck or whatever and it was straight forward to improve that... but whatever the text, if I open a link from email the first thing I look at is…

Unicode means that domain names can be different and look the same unless you really look close. Even if you just stick to ascii l (letter) and 1 (number) look so close that I would expect many people to not see the difference if it isn't pointed out. (remember you don't control the font in use, some are more different than others)

I think, firefox allows you to display url without uncicode

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#85

Post by diggan »

herpdyderp wrote: post #59
hfmuehleisen wrote: post #24

Earlier quoted context omitted.

Yes we tried, but npm would not let us because of "dependencies". We've reached out to them and are waiting for a response. In the meantime, we re-published the packages with newer versions so people won't accidentally install the compromised version.

At least one thing is clear from this week: npm is too slow to respond.

> npm is too slow to respond

Microsoft has been bravely saying "Security is top priority" since 2002 (https://www.cnet.com/tech/tech-industry/gates-security-is-to...) and every now and then reminds us that they put "security above all else" (latest in 2024: https://blogs.microsoft.com/blog/2024/05/03/prioritizing-sec...), yet things like this persists.

For how long time do Microsoft need to leave wide-open holes for the government to crack down on their wilful ignorance? Unless people go to jail, literally nothing will happen.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#86

Post by zokier »

elric wrote: post #74

This is critical infrastructure, and it gets compromised way too often. There are so many horror stories of NPM (and similar) packages getting filled with malware. You can't rely on people not falling for phishing 100% of the time. People who publish software packages tend to be at least somewhat technical people. Can package publishing platforms PLEASE start SIGNING emails. Publish GPG keys (or whatever, I don't car…

Spf/dkim already authenticates the sender. But it doesn't help if the user doesn't check who the email is from. But in that case gpg would not help that much either.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#87

Post by jasode »

IshKebab wrote: post #44
diggan wrote: post #12

So far, it seems to be a bog-standard phishing email, with not much novelty or sophistication, seems the people running the operation got very lucky with their victims though. I'm starting to think we haven't even seen the full scope of it yet, two authors confirmed as compromised, must be 10+ out there we haven't heard of yet?

Probably the differentiating factor here is that the phishing message was very plausible. Normally they're full of spelling mistakes and unprofessional grammar. The domain was also plausible. I think where they got lucky is > In hindsight, the fact that his browser did not auto-complete the login should have been a red flag. A huge red flag. I wonder if browsers should actually detect if you're putting login details…

> In hindsight, the fact that his browser did not auto-complete the login should have been a red flag.

>A huge red flag.

It won't be a red flag for people who often see auto-complete not working for legitimate websites. The usual cause is legitimate websites not working instead of actual phishing attempts.

This unintended behavior of password managers changes the Bayesian probabilities in the mind such that username/password fields that remain unfilled becomes normal and expected. It inadvertently trains sophisticated people to lower their guard. I wrote more on how this happens to really smart technical people: https://news.ycombinator.com/item?id=45179643

>So are there mobile password managers that don't even check the URL? I dunno how that works...

Strongbox pw manager on iOS by default doesn't autofill. You have to go settings to specifically enable that feature. If you don't, it's copy&paste.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#88

Post by kaoD »

eviks wrote: post #67
stanac wrote: post #64

Earlier quoted context omitted.

My password manager is a separate app, I always have to manually copy/paste the credentials. That's because I believed that approach to be more secure, now I see it's replacing one attack vector for another.

What's the most common example of an alternative attack with autofill?

The password manager's autofill browser extension gets compromised.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#90

Post by polynomial »

diggan wrote: post #12

So far, it seems to be a bog-standard phishing email, with not much novelty or sophistication, seems the people running the operation got very lucky with their victims though. I'm starting to think we haven't even seen the full scope of it yet, two authors confirmed as compromised, must be 10+ out there we haven't heard of yet?

The article says the victim used 2fa. How did the attacker know their 2fa in order to send them a fake 2fa request?
Post reply on HN