Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

socket.dev

Post reply on HN
Print view View original

801–810 of 1001 posts

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#801

Post by saleCz »

viraptor wrote: post #50
diggan wrote: post #24

Earlier quoted context omitted.

> How many tokens do you have lying around in your home directory in plain text, able to be read by anything on your computer running as your user? Zero? How many developers have plain-text tokens lying around on disk? Avoiding that been hammered into me from every developer more senior than me since I got involved with professional software development.

> How many developers have plain-text tokens lying around on disk? Most of them. Mainly on purpose, (.env files) but many also accidentally. (shell history with tokens in the commands)

Exactly. There are tools that allow debugging production environments without having to have the credentials on your disk.

I recommend Envie: https://github.com/ilmari-h/envie

It's more convenient than having a bunch of .env.prod, .env.staging files laying around, not to mention more secure.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#802

Post by wolvesechoes »

whstl wrote: post #559
ncruces wrote: post #511

Earlier quoted context omitted.

Just the other day someone argued with me that it was reasonable for Limbo (the SQLite Rust rewrite) to have 3135 dependencies (of those, 1313 Rust dependencies). https://github.com/tursodatabase/turso/network/dependencies

This is incredible. At this rate, there's a non-zero chance that one of the transitive dependencies is SQLite itself.

But it will be safe SQlite, called from Rust.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#803

Post by wolvesechoes »

Klonoar wrote: post #352
johnisgood wrote: post #208

Earlier quoted context omitted.

Well, your typical Rust project has over 1000 dependencies, too. Zed has over 2000 in release mode.

Your typical Rust project does not have over 1000 dependencies. Zed is not a typical Rust project; it's a full fledged editor that includes a significant array of features and its own homegrown UI framework .

> Zed is not a typical Rust project; it's a full fledged editor

Funny that text editor is being presented here as some kind of behemoth, not representative of typical software written in Rust. I guess typical would be 1234th JSON serialization library.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#804

Post by PeterStuer »

kelnos wrote: post #405

As a user of npm-hosted packages in my own projects, I'm not really sure what to do to protect myself. It's not feasible for me to audit every single one of my dependencies, and every one of my dependencies' dependencies, and so on. Even if I had the time to do that, I'm not a typescript/javascript expert, and I'm certain there are a lot of obfuscated things that an attacker could do that I wouldn't realize was embed…

Not you. But one would expect major cybersecurity vendors such as Crowdstrike to screen their dependencies, yet they are all over the affected list.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#805

Post by junon »

codemonkey-zeta wrote: post #31

I'm coming to the unfortunate realizattion that supply chain attacks like this are simply baked into the modern JavaScript ecosystem. Vendoring can mitigate your immediate exposure, but does not solve this problem. These attacks may just be the final push I needed to take server rendering (without js) more seriously. The HTMX folks convinced me that I can get REALLY far without any JavaScript, and my apps will probab…

This is going to become an issue for a lot of managers, not just npm. Npm is clearly a very viable target right now, though. They're going to get more and more sophisticated.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#806

Post by ricardobeat »

ncruces wrote: post #511
jen20 wrote: post #471

Earlier quoted context omitted.

Zero-external-dependency Go apps are far more feasible than Rust or Node, simply because of the size and quality of the standard library.

Just the other day someone argued with me that it was reasonable for Limbo (the SQLite Rust rewrite) to have 3135 dependencies (of those, 1313 Rust dependencies). https://github.com/tursodatabase/turso/network/dependencies

Even more wild considering that SQLite prides itself on having zero dependencies. Sounds like a doomed project.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#807

Post by ricardobeat »

hedora wrote: post #651
worik wrote: post #505

Earlier quoted context omitted.

> This is a culture issue with developers who find it OK to have hundreds of (transitive) dependencies, and then follow processes that, for all intents and purposes, blindly auto update them I do not know about NPM. But in Rust this is common practice. Very hard to avoid. The core of Rust is very thin, to get anything done typically involves dozens of crates, all pulled in at compile time from any old developer impli…

The same is true for go and for java.

You can write entire applications in Go without resorting to any dependencies, the std lib is quite complete.

Most projects will have a healthy 5-20 dependencies though, with very little nested modules.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#808

Post by ricardobeat »

SCdF wrote: post #796
snickerbockers wrote: post #774

I try to stay as far from web development as possible in my programming career (kernel/drivers and most recently reverse engineering) so maybe I'm ill-informed here but this npm thing seems to be uniquely terrible at security and i cannot fathom why the entire web seems to be automatically downloading updates from it and pushing them into production with no oversight. I've always worked at companies where we use thir…

A lot of it is just that it's at the local maximum of popularity and relative user inexperience, so it's the juiciest target. But also, npm was very much (like js you could argue) vibed into existence in many ways, eg with the idea of a lock file (eg reproducible builds) _at all_ taking a very long time to take shape.

We got lockfiles in 2016 (yarn) and 2017 (npm), before Go, Ruby, and others; I believe python is just getting a lockfile standard approved now.

You could already specify exact versions in your package.json, same as a Gemfile, but reality is that specifying dependencies by major version or “*” was considered best practice, to always have the latest security updates. Separating version ranges from the lock files, and requiring explicit upgrades was a change in that mindset – and mostly driven by containerization rather than security or dev experience.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#809

Post by xorcist »

autoexec wrote: post #685
gameman144 wrote: post #439

Earlier quoted context omitted.

It isn't feasible to audit every line of every dependency, just as it's not possible to audit the full behavior of every employee that works at your company. In both cases, the solution is similar: try to restrict access to vital systems only to those you trust,so that you have less need to audit their every move. Your system administrators can access the server room, but the on-site barista can't. Your HTTP server i…

> It isn't feasible to audit every line of every dependency, just as it's not possible to audit the full behavior of every employee that works at your company. Your employees are carefully vetted before hiring. You've got their names, addresses, and social security numbers. There's someone you're able to hold accountable if they steal from you or start breaking everything in the office. This seems more like having se…

That hit much too close to reality. It's exactly like that. Even the names were spot on!

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#810

Post by Ygg2 »

ncruces wrote: post #788
Ygg2 wrote: post #670

Earlier quoted context omitted.

Yeah. You have dev dependencies in there, those alone will increase number of dependencies by ~500, without ending up in the final product. Those numbers are way off their actual number.

Right. Allowing 500 strangers to push code to our CI infra, or developer laptops, with approximately zero review, sounds similarly ill advised. That JLR got their factories hacked, rather than customer cars , is less bad for sure. But it's still pretty bad. Also, before arguing that code generators should get a pass as they don't “end up in the final product”, you really should read “Reflections on trusting trust” by…

> Right. Allowing 500 strangers to push code to our CI infra

That's bullshit, pure and simple. If you pull in a deeply nested dependency like icu_normalizer it has 30 dependencies, OMGHAXOZRS. I'm doing this, so I don't have to spend a day going through the library.

Except of the 30 depedencies crates, there are 10 from ICUX repository, and then you have almost standard dependencies like proc-macro/syn/quote crates from dtolnay, `zerofrom` from Google. `smallvec` from the Servo project, and yoke from... checks notes... from ICUX.

The only few remaining crates here are `write16`, `utf8_iter` and `utf16_iter` that are written from hsivonen, who is also a ICUX contributor.

So even for 30 dependencies, you actually depend on proc-macro/syn/quote which are foundational crates. Few crates from Google, few crates from Servo, and three crates written by another ICUX contributor.

We started with 30 dependencies and ended up with 3 strangers

Post reply on HN