Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

socket.dev

Post reply on HN
Print view View original

861–870 of 1001 posts

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#861

Post by user34283 »

zelphirkalt wrote: post #142
homebrewer wrote: post #66

When the left-pad debacle happened, one commenter here said of a well known npm maintainer something to the effect of that he's an "author of 600 npm packages, and 1200 lines of JavaScript". Not much has changed since then. The best counter-example I know is esbuild, which is a fully featured bundler/minifier/etc that has zero external dependencies except for the Go stdlib + one package maintained by the Go project i…

The answer is to not draw in dependencies for things you are easily able to write yourself. That would probably reduce dependencies by 2/3 or so in many projects. Especially, left-pad things. If you write properly self contained small parts and a few tests, you probably don't have to touch them much, and the maintenance burden is not that high. Compare that with having to check every little dependency like left pad a…

That's not an answer at all. Jest alone adds 300 packages.

Why don't you share with us what your project does and how many packages are present?

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#862

Post by jcgl »

l___l wrote: post #10

Is there a theoretical framework that can prevent this from happening? Proof-carrying code?

I think I’m gonna start wrapping most of my build commands (which are inside a makefile) with bwrap. Allow network access only for fetching dependencies. Limit disk access (especially rw access) throughout. Etc.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#863

Post by user34283 »

snickerbockers wrote: post #774

I try to stay as far from web development as possible in my programming career (kernel/drivers and most recently reverse engineering) so maybe I'm ill-informed here but this npm thing seems to be uniquely terrible at security and i cannot fathom why the entire web seems to be automatically downloading updates from it and pushing them into production with no oversight. I've always worked at companies where we use thir…

While npm indeed seems most vulnerable, it looks to me like the actual damage done is very small.

Some people had their crypto wallets drained I guess, but as far as I am concerned nothing of any real value was lost.

One could argue that your field saw exploits that did far more damage, no?

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#865

Post by amai »

paulirish wrote: post #257

This vulnerability was reported to NPM in 2016: https://blog.npmjs.org/post/141702881055/package-install-scr... https://www.kb.cert.org/vuls/id/319816 but the NPM response was WAI.

NPM belongs to Microsoft. What do you expect?

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#866

Post by 999900000999 »

wvh wrote: post #823
kelnos wrote: post #405

As a user of npm-hosted packages in my own projects, I'm not really sure what to do to protect myself. It's not feasible for me to audit every single one of my dependencies, and every one of my dependencies' dependencies, and so on. Even if I had the time to do that, I'm not a typescript/javascript expert, and I'm certain there are a lot of obfuscated things that an attacker could do that I wouldn't realize was embed…

As a security guy, for years, you get laughed out of the room suggesting devs limit their dependencies and don't download half of the internet while building. You are an obstruction for making profit. And obviously reading the code does very little since modern (and especially Javascript) code just glues together frameworks and libraries, and there's no way a single human being is going to read a couple million lines…

The "solution" would be using a language with a strong standard library and then having a trusted 3rd party manually audit any approved packages.

THEN use artifactory on top of that.

That's boring and slow though. Whatever I want my packages and I want them now. Apart of the issue is the whole industry is built upon goodwill and hope.

Some 19 year old hacked together a new front end framework last week, better use it in prod because why not.

Occasionally I want to turn off my brain and just buy some shoes. The Timberland website made that nearly impossible last week. When I gave up on logging in for free shipping and just paid full price, I get an email a few days later saying they ran out of shoes.

Alright. I guess Amazon is dominant for a reason.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#867

Post by 1oooqooq »

kelnos wrote: post #405

As a user of npm-hosted packages in my own projects, I'm not really sure what to do to protect myself. It's not feasible for me to audit every single one of my dependencies, and every one of my dependencies' dependencies, and so on. Even if I had the time to do that, I'm not a typescript/javascript expert, and I'm certain there are a lot of obfuscated things that an attacker could do that I wouldn't realize was embed…

would you pay a subscription for a vetted repo?

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#868

Post by 1oooqooq »

wereHamster wrote: post #779
isbvhodnvemrwvn wrote: post #755

Earlier quoted context omitted.

Renovate is not commercial, it's an own source dependabot, quite more copable at that.

AGPL is a no-go for many companies (even when it's just a tool that touches your code and not a dependency you link to).

good. that's the point.

agpl is a no go for companies not intending to ever contribute anything back. good riddance.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#869

Post by 1oooqooq »

vvpan wrote: post #541
TZubiri wrote: post #509

Earlier quoted context omitted.

Install less dependencies, code more.

Copy-paste more.

wonder how long for llms to spew the malware in those packages along the code when you request the same functionality.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#870

Post by zelphirkalt »

user34283 wrote: post #861
zelphirkalt wrote: post #142

Earlier quoted context omitted.

The answer is to not draw in dependencies for things you are easily able to write yourself. That would probably reduce dependencies by 2/3 or so in many projects. Especially, left-pad things. If you write properly self contained small parts and a few tests, you probably don't have to touch them much, and the maintenance burden is not that high. Compare that with having to check every little dependency like left pad a…

That's not an answer at all. Jest alone adds 300 packages. Why don't you share with us what your project does and how many packages are present?

My current project? Not sure what that has to do with the discussion, but my current project uses only a tiny bit of JS and has a fallback for users who don't run JS. It is a few pages taking a file to upload and the all the actual sauce is in the backend, and it is rendering templates.

So I simply avoid the whole problem altogether in my current project. But aside from the JS stuff, the backend is in Python and I avoid adding dependencies from PyPI wherever possible. For example I had the choice of going with Pydantic and dataclasses and whatnot, but I resisted that, and came up with a quite minimalistic way to type check JSON documents, that is contained in one short module and easily extensible. Does it go to the same length as pydantic? No, it doesn't. If it did, I would be a genious. But it is quite sufficient for type safety in my project.

Keeping things simple is possible, if we set our minds to it. Sometimes one cannot avoid a big dependency, sure, but in many cases we actually can! We just need to beat that beast of habit of quickly adding a familiar dependency without thinking about the cost.

Post reply on HN