Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

socket.dev

Post reply on HN
Print view View original

841–850 of 1001 posts

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#841

Post by user34283 »

autoexec wrote: post #689
respondo2134 wrote: post #579

Earlier quoted context omitted.

>> and keeping them to well-known and trustworthy (security-wise) creators. The true threat here isn't the immediate dependency though, it's the recursive supply chain of dependencies. "trustworthy" doesn't make any sese either when the root cause is almost always someone trustworthy getting phished. Finally if I'm not capable of auditing the dependencies it's unlikely I can replace them with my own code. That's like…

> Finally if I'm not capable of auditing the dependencies it's unlikely I can replace them with my own code. That's like telling a vibe coder the solution to their brittle creations is to not use AI and write the code themselves. In both cases, actually doing the work and writing a function instead of adding a dependency or asking an AI to write it for you will probably make you a better coder and one who is better a…

Just like it's going to make you a better engineer if you design the microchips in your workstation yourself instead of buying an x86 CPU.

It's still neither realistic nor helpful advice.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#842

Post by l___l »

pjc50 wrote: post #58
killerstorm wrote: post #29

Earlier quoted context omitted.

Object-capability model / capability-based security. Do not let code to have access to things it's not supposed to access. It's actually that simple. If you implemented a function which formats a string, it should not have access to `readFile`, for example. Retrofitting it into JS isn't possible, though, as language is way too dynamic - self-modifying code, reflection, etc, means there's no isolation between modules.…

People have tried this, but in practice it's quite hard to do because then you have to start treating individual functions as security boundaries - if you can't readFile, just find a function which does it for you. The situation gets better in monadic environments (can't readFile without the IO monad, and you cant' call anything which would read it).

Can it be done by restricting the readFile capability between code boundaries instead of restrict it from a specific function? Then it doesn't matter if you know of another function which does it for you.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#843

Post by Hilift »

kelnos wrote: post #405

As a user of npm-hosted packages in my own projects, I'm not really sure what to do to protect myself. It's not feasible for me to audit every single one of my dependencies, and every one of my dependencies' dependencies, and so on. Even if I had the time to do that, I'm not a typescript/javascript expert, and I'm certain there are a lot of obfuscated things that an attacker could do that I wouldn't realize was embed…

> I'm not really sure what to do

You need an EDR and code repo scanner. Exploring this as a technical problem of the infrastructure will accomplish. The people that create these systems are long gone and had/have huge gaps in their capabilities to stop creating these problems.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#844

Post by singulasar »

sauercrowd wrote: post #595
advocatemack wrote: post #250

Earlier quoted context omitted.

Mackenzie here I work for Aikido. This is a classic example of the security community all playing a part. The very first notice of this was from a developer named Daniel Pereira. He alerted Socket who did the first review of the Malware and discovered 40 packages. After, Aikido discovered an additional 147 packages and the Crowdstrike packages. I'm not sure how Step found it but they were the first to really understa…

question how does your product help in these situations? I imagine it'd require for someone to report a compromised package, and then you guys could detect it in my codebase?

Yes to the you guys can detect it in my codebase, but it's generally not required for someone to report a compromised package, we do also discover them ourselves quite fast due to automated scans of npm package updates. This is how aikido was first to discover the previous supply chain hack.

The easiest way for you to use our product to be protected is actually using one of our free open source tools. https://www.npmjs.com/package/@aikidosec/safe-chain

This is a wrapper around npm etc that will prevent you from installing malware

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#845

Post by user34283 »

jitix wrote: post #714
rectang wrote: post #423

Earlier quoted context omitted.

It's not unreasonable to trust large numbers of trustworthy dependency authors. What we lack are the institutions to establish trust reliably. If packages had to be cryptographically signed by multiple verified authors from a per-organization whitelist in order to enter distribution, that would cut down on the SPOF issue where compromising a single dev is enough to publish multiple malware-infested packages.

It IS unreasonable to trust individual humans across the globe in 100+ different jurisdictions pushing code that gets bundled into my application. How can you guarantee a long trusted developer doesn't have a gun pointed to their head by their authoritarian govt? In our B2B shop we recently implemented a process where developers cannot add packages from third party sources - only first party like meta, google, spring…

If someone is wondering how effective such an approach is going to be with npm, consider the following:

If you add jest, the popular test runner by Meta, that's adding 300 packages to your dependency graph.

And here we don't yet have a bundler, linter, code formatter, or even web framework.

So good luck with minimizing those dependencies.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#846

Post by singulasar »

kjok wrote: post #332
progbits wrote: post #220

Earlier quoted context omitted.

NPM is owned by github/microsoft. I'm sure they could afford to buy one of these products or just build their own, but clearly security is not a thing they care about.

Why should MS buy any of these startups when a developer (not any automated tech) found the malware? It looks like these startups did after-the-fact analysis for PR.

on the other hand, the previous supply chain attack was found by automated tech. Also, if MS would be so kind as to just run similar scans at the time a package is updated instead of after the package is updated (which is the only way the automated tech can run if npm doesn't integrate it), then malware like this would be way less common.

MS doesn't care

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#847

Post by user34283 »

skydhash wrote: post #200
WD-42 wrote: post #190

Earlier quoted context omitted.

Javascript doesn't have a standard library, until it does the 170 million[1] weekly downloads of packages like UUID will continue. You can't expect people to re-write everything over and over. [1] https://www.npmjs.com/package/uuid

You have the DOM and Node APIs. Which I think cover more than C library or Common Lisp library. Adding direct dependencies is done by every project. The issue is the sprawling deps tree of NPM and JS culture. > You can't expect people to re-write everything over and over. That’s the excuse everyone is giving, then you see thousands of terminal libraries and calendar pickers.

It's a waste of time to strictly vet dependencies on my side when adding the standard test runner by Meta - jest - alone adds 300 packages to my dependency graph.

So yes, the sprawling deps tree and culture is the problem. We would need to start reducing dependencies of the basic tools first. Otherwise it seems rather pointless to bother app developers with reducing dependencies.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#848

Post by zelphirkalt »

jand wrote: post #817
zelphirkalt wrote: post #508

Earlier quoted context omitted.

That's because there many people don't feel like it is their duty to do good work, even though they are paid ...

Who do you mean with "many people"? Developers who do not care or middle management that oversold features and overcommitted w.r.t. deadlines? Or both? Someone else?

I was thinking of many developers, but actually middle management should be included.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#849

Post by zelphirkalt »

bobthepanda wrote: post #681
wongarsu wrote: post #657

Earlier quoted context omitted.

The perfect storm of on the one side junior developers who are afraid of writing even trivial code and are glad if there's a package implementing functionality that can be done in a one-liner, and on the other side (often junior) developers who want to prove themselves and think the best way to do that is to publish a successful npm package

The blessing and curse of frontend development is that there basically isn't a barrier to entry given that you can make some basic CSS/JS/HTML and have your browser render it immediately. There's also the flavor of frontend developer that came from the backend and sneers at actually having to learn frontend because "it's not real development"

Ha, that's a funny attitude. And here I was thinking, that mostly doing backend work, I rather make the best out of the situation, if I have to do frontend dev, and try to do "real development" by writing trivial things myself, instead of worsening the situation by gluing together mountains of bloat.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#850

Post by meh3749823 »

snickerbockers wrote: post #774

I try to stay as far from web development as possible in my programming career (kernel/drivers and most recently reverse engineering) so maybe I'm ill-informed here but this npm thing seems to be uniquely terrible at security and i cannot fathom why the entire web seems to be automatically downloading updates from it and pushing them into production with no oversight. I've always worked at companies where we use thir…

[dead]
Post reply on HN