Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

socket.dev

Post reply on HN
Print view View original

871–880 of 1001 posts

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#871

Post by silverliver »

999900000999 wrote: post #866
wvh wrote: post #823

Earlier quoted context omitted.

As a security guy, for years, you get laughed out of the room suggesting devs limit their dependencies and don't download half of the internet while building. You are an obstruction for making profit. And obviously reading the code does very little since modern (and especially Javascript) code just glues together frameworks and libraries, and there's no way a single human being is going to read a couple million lines…

The "solution" would be using a language with a strong standard library and then having a trusted 3rd party manually audit any approved packages. THEN use artifactory on top of that. That's boring and slow though. Whatever I want my packages and I want them now. Apart of the issue is the whole industry is built upon goodwill and hope. Some 19 year old hacked together a new front end framework last week, better use it…

This is the right answer. I'm willing to stick my head out and assert that languages with a "minimal" standard library are defective by design. The argument of APIs being stuck is mood with approaches like Rust's epocs or "strict mode".

Standard libraries should include everything needed to interact with modern systems. This means HTTP parsing, HTTP requests, and JSON parsing. Some laguages are excellent (like python), while some are half way there (like go), and some are just broken (Rust).

External libraries are for niche or specialized functionality. External libraries are not for functionality that is used by most modern software. To put your head in the ground and insist otherwise is madness and will lead to ridiculous outcomes like this.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#872

Post by user34283 »

zelphirkalt wrote: post #870
user34283 wrote: post #861

Earlier quoted context omitted.

That's not an answer at all. Jest alone adds 300 packages. Why don't you share with us what your project does and how many packages are present?

My current project? Not sure what that has to do with the discussion, but my current project uses only a tiny bit of JS and has a fallback for users who don't run JS. It is a few pages taking a file to upload and the all the actual sauce is in the backend, and it is rendering templates. So I simply avoid the whole problem altogether in my current project. But aside from the JS stuff, the backend is in Python and I av…

So you're not using the npm ecosystem at all.

Surely you see how that might be relevant to the discussion where you appeared to give advice on how to solve the npm dependency graph problem.

That you're not using npm or other node package managers at all is the key information here. Not that it's invalid, but it's a very different setup.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#874

Post by fatchan »

2muchcoffeeman wrote: post #462
gameman144 wrote: post #416

Earlier quoted context omitted.

> It's not feasible for me to audit every single one of my dependencies, and every one of my dependencies' dependencies I think this is a good argument for reducing your dependency count as much as possible, and keeping them to well-known and trustworthy (security-wise) creators. "Not-invented-here" syndrome is counterproductive if you can trust all authors, but in an uncontrolled or unaudited ecosystem it's actually…

Have we all forgotten the left-pad incident? This is an eco system that has taken code reuse to the (unreasonable) extreme. When JS was becoming popular, I’m pretty sure every dev cocked an eyebrow at the dependency system and wondered how it’d be attacked.

1.2 million weekly downloads to this day, when we've had builtin padStart since ES2017.

Yes, I remember thinking at the time "how are people not ashamed to install this?"

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#876

Post by theodorejb »

VPenkov wrote: post #833
theodorejb wrote: post #276

It's crazy to me that npm still executes postinstall scripts by default for all dependencies. Other package managers (Pnpm, Bun) do not run them for dependencies unless they are added to a specific allow-list. Composer never runs lifecycle scripts for dependencies. This matters because dependencies are often installed in a build or development environment with access to things that are not available when the package…

It does not, since version 11: https://docs.npmjs.com/cli/v11/using-npm/changelog#1100-pre0...

Yes it does, since the ignore-scripts option is not enabled by default.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#877

Post by user3939382 »

999900000999 wrote: post #866
wvh wrote: post #823

Earlier quoted context omitted.

As a security guy, for years, you get laughed out of the room suggesting devs limit their dependencies and don't download half of the internet while building. You are an obstruction for making profit. And obviously reading the code does very little since modern (and especially Javascript) code just glues together frameworks and libraries, and there's no way a single human being is going to read a couple million lines…

The "solution" would be using a language with a strong standard library and then having a trusted 3rd party manually audit any approved packages. THEN use artifactory on top of that. That's boring and slow though. Whatever I want my packages and I want them now. Apart of the issue is the whole industry is built upon goodwill and hope. Some 19 year old hacked together a new front end framework last week, better use it…

I don’t recall hearing about constant supply chain attacks with CPAN

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#878

Post by Loudergood »

999900000999 wrote: post #866
wvh wrote: post #823

Earlier quoted context omitted.

As a security guy, for years, you get laughed out of the room suggesting devs limit their dependencies and don't download half of the internet while building. You are an obstruction for making profit. And obviously reading the code does very little since modern (and especially Javascript) code just glues together frameworks and libraries, and there's no way a single human being is going to read a couple million lines…

The "solution" would be using a language with a strong standard library and then having a trusted 3rd party manually audit any approved packages. THEN use artifactory on top of that. That's boring and slow though. Whatever I want my packages and I want them now. Apart of the issue is the whole industry is built upon goodwill and hope. Some 19 year old hacked together a new front end framework last week, better use it…

I agree, it always seems to be NPM, and there's a reason for that.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#880

Post by TZubiri »

Eisenstein wrote: post #790
respondo2134 wrote: post #599

Earlier quoted context omitted.

Reductio ad Absurdum may be what you're thinking of, but Straw Man might also apply. Funny enough the responder didn't actually do what you said. They stated of the 600+ dependencies they counted there was only one they felt comfortable implementing themselves. Your accusation of them taking your statement to the extreme is reverse straw man rhetoric; you're misrepresenting their argument as extreme or absurd when it…

Reductio ad Absurdum is not a fallacy but a legitimate rhetorical technique where you can point out obvious flaws in logic by taking that logic and applying it to something that people would find ridiculous. Note that this is not the most 'extreme' version, it is the same version, using the same logic. Example: Argument: People should be able to build whatever they want on their own property. Reductio ad Absurdum pos…

Just wanted to comment that chatgpt also wrongly categorizes this as reductio ad absurdum and strawman.

This is very dead internet theory, but not automated, someone copied my comment, gave it to chatgpt, and returned the chatgpt answer, presumably passing it off as their own, but in effect we are talking with chatgpt lol.

Post reply on HN