Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

70% of new NPM packages in last 6 months were spam

blog.phylum.io

Post reply on HN
Print view View original

91–100 of 116 posts

Re: 70% of new NPM packages in last 6 months were spam

#91

Post by lolinder »

marginalia_nu wrote: post #89
lolinder wrote: post #69

Earlier quoted context omitted.

You're doing it again, though: are "this particular problem" and "these problems" the tea.yaml spam? The million tiny packages problem I mentioned? The fact that people online will generically attack the ecosystem without being specific about their complaints? I'm not asking for solutions, and I'm not asking for people to identify casual factors. I'm asking for people to put a little bit more effort into their critic…

"70% of new NPM packages in last 6 months were spam"

So we're specifically talking about the tea.yaml spam. More than any other topic that seems like one that is worth digging into details on rather than just shrugging and saying isolating causality is hard.

If we look at the chart in the original article [0] that this one is a follow up to, the NPM spam suddenly picked up around the end of February, with new packages per day first doubling and then tripling. So this 70% figure is specific to the last 6 months, not something that has been the case with the ecosystem for a long time.

That makes tracing causality much simpler: the Tea protocol seems to be pretty clearly the source of the problem. The big open question is why NPM, but the way that people jump to the conclusion that NPM being the target of this attack must have something to do with the flaws in the ecosystem smacks of victim blaming. Isn't it just as possible that NPM was targeted because it's huge? If you're going to run a massive spam campaign you do it where the people are.

Could NPM learn from this and start controlling spam better? Yes! But That's not the same thing as attributing this tea.yaml nonsense to systemic flaws in the ecosystem—spam prevention has to be balanced with usability, and the balance was pretty decent until 6 months ago.

[0] https://blog.phylum.io/digital-detritus-unintended-consequen...

Re: 70% of new NPM packages in last 6 months were spam

#92

Post by vb-8448 »

Mashimo wrote: post #26
vb-8448 wrote: post #5

I wonder what is the long term plan. Maybe the next step is to sell the control of all these packages to a rogue entity to be used for a supply chain attack?

But who would use those spam packages in their project? Don't don't do anything.

I don't know if they managed to fix it in recent years, but JS dependencies management used to be broken. I think the left-pad[0] incident is the most known one, but not the unique one. My guess is that you spam enough, at some point in time one of the packages will go viral.

[0] https://en.wikipedia.org/wiki/Npm_left-pad_incident

Re: 70% of new NPM packages in last 6 months were spam

#94

Post by vb-8448 »

Cthulhu_ wrote: post #10
vb-8448 wrote: post #5

I wonder what is the long term plan. Maybe the next step is to sell the control of all these packages to a rogue entity to be used for a supply chain attack?

Would you be at all surprised? I'm fairly confident that like with browser addons, NPM package maintainers get offers from randoms to 'buy' their package in order to get backdoor access. A secured registry is long overdue, where every release gets an audit report verifying the code and authorship of a new release. It won't be nearly as fast as regular NPM package development but that's a good thing, this is intended…

> Would you be at all surprised

Actually no, I just wonder why no one takes seriously these types of risks.

Supply chain attacks are a thing nowadays, but no one really cares, 6 months ago we had the xz attack but basically no one remember about it today.

Re: 70% of new NPM packages in last 6 months were spam

#95

Post by sumtechguy »

sabbaticaldev wrote: post #67
sumtechguy wrote: post #63

Earlier quoted context omitted.

I am not sure I am following that this fits the broken window fallacy? That fallacy is 'if I break/destroy something I create value on other things'. I am actually curious how spamming a bunch of accounts with junk in them would fit that? Oh no doubt it is creating negative value but nothing is destroyed to do that. 'Broken window' is probably not the right pattern here? I can think of a couple of other terms that fi…

I think you are making a confusion about what's the broken windows theory, I suggest reading about it: https://en.wikipedia.org/wiki/Broken_windows_theory

ah I see my mistake.

Re: 70% of new NPM packages in last 6 months were spam

#96

Post by pas »

3np wrote: post #25
NikxDa wrote: post #2

> Contrary to what npm states, this package actually depends on one of our aforementioned spam packages. This is a by-product of how npm handles and displays dependencies to users on its website. For me personally, this is the biggest surprise and takeaway here. By simply having a key inside package.json's dependencies reference an existing NPM package, the NPM website links it up and counts it as a dependency, regar…

You should think of the package metadata as originating from the publisher, not from the registry. Aside from the name, version, and (generated) dist and maintainers fields, I don't think any of it is even supposed to be validated by the registry? Agreed the website UX is confusing and could be better but in general package metadata is just whatever the publisher put there and it's up to you to verify if you care abo…

the fucking website processes it and after some mighty compute somehow shits out the wrong link. it's actively making things worse by trying to be helpful.

confusing is one thing, but there's a screaming security chasm around that innocent little UX problem.

MS bought npmjs and now it's LARPing as some serious ecosystem (by showing how many unresolved security notices installed packages have) while they cannot be arsed to correctly show what's actually in the metadata?

Re: 70% of new NPM packages in last 6 months were spam

#97

Post by marcosdumay »

lolinder wrote: post #57
bigDinosaur wrote: post #30

Earlier quoted context omitted.

The entire NPM ecosystem is a garbage fire. Who cares about whatever 'principles' it supposedly has? Other than avoiding malware I can't think of something I care about less than whatever principles NPM / JS developers in general have because they've mostly been bad so far. I wouldn't be surprised if principles in this case leave us with thousands of spam packages degrading the node ecosystem forever. It'd be exactly…

I know it's a meme on HN to rant about the terrible JavaScript ecosystem and how bad JS developers are, but I would ask that if you're going to do it you be specific about what you mean instead of just generally accusing it of being "bad". It's not even that I disagree, it's that it's a conversation killer. "The JS ecosystem is bad" has no response someone could make besides "no it's not", which is boring. "The JS ec…

The JS ecosystem doesn't have any singular bad feature that other languages do not share.

Instead, what it does have is a huge prevalence of those features, and minimal size of a "safe space" where one can have some confidence they will not appear. Both of those are quantitative differences, that people can not summarize in a short comment, and people can easily dismiss with (misguided or dishonest) counterexamples.

So, what you are asking for is a full blown large scale study of several ecosystems. Somebody may do something like that, but not for a comment, and not because you asked.

Re: 70% of new NPM packages in last 6 months were spam

#98

Post by throwitaway1123 »

Cthulhu_ wrote: post #10
vb-8448 wrote: post #5

I wonder what is the long term plan. Maybe the next step is to sell the control of all these packages to a rogue entity to be used for a supply chain attack?

Would you be at all surprised? I'm fairly confident that like with browser addons, NPM package maintainers get offers from randoms to 'buy' their package in order to get backdoor access. A secured registry is long overdue, where every release gets an audit report verifying the code and authorship of a new release. It won't be nearly as fast as regular NPM package development but that's a good thing, this is intended…

> A secured registry is long overdue, where every release gets an audit report verifying the code and authorship of a new release.

Microsoft did exactly that (since they own both NPM and Github) by allowing you to verify the provenance of NPM packages built using Github Actions [1]. It's not required for all packages though. They've also started requiring all "high impact" packages to use two factor authentication [2].

[1] https://github.blog/security/supply-chain-security/introduci...

[2] https://github.blog/changelog/2022-11-01-high-impact-package...

Re: 70% of new NPM packages in last 6 months were spam

#99

Post by throwitaway1123 »

vb-8448 wrote: post #92
Mashimo wrote: post #26

Earlier quoted context omitted.

But who would use those spam packages in their project? Don't don't do anything.

I don't know if they managed to fix it in recent years, but JS dependencies management used to be broken. I think the left-pad[0] incident is the most known one, but not the unique one. My guess is that you spam enough, at some point in time one of the packages will go viral. [0] https://en.wikipedia.org/wiki/Npm_left-pad_incident

This was fixed years ago, and of course people then complained about not being able to remove their packages [1].

[1] https://news.ycombinator.com/item?id=38874874

Re: 70% of new NPM packages in last 6 months were spam

#100

Post by lolinder »

marcosdumay wrote: post #97
lolinder wrote: post #57

Earlier quoted context omitted.

I know it's a meme on HN to rant about the terrible JavaScript ecosystem and how bad JS developers are, but I would ask that if you're going to do it you be specific about what you mean instead of just generally accusing it of being "bad". It's not even that I disagree, it's that it's a conversation killer. "The JS ecosystem is bad" has no response someone could make besides "no it's not", which is boring. "The JS ec…

The JS ecosystem doesn't have any singular bad feature that other languages do not share. Instead, what it does have is a huge prevalence of those features, and minimal size of a "safe space" where one can have some confidence they will not appear. Both of those are quantitative differences, that people can not summarize in a short comment, and people can easily dismiss with (misguided or dishonest) counterexamples.…

I ask because I don't believe the JS ecosystem is notably worse than the Python ecosystem or the Java ecosystem and I'm tired of the meme of railing on JS developers when what people are really railing against is developers in general.

All ecosystems that are sufficiently popular have terrible problems. They have different problems, but none is consistently pleasant to work with. Out of all of them, though, JS gets singled out for constant attacks because... reasons.

I just want people to identify what those reasons are so we can have a conversation about them rather than just endlessly repeating the meme.

Post reply on HN