...so far...
'No way to prevent this,' says only package manager where this regularly happens
91–100 of 230 posts
Re: 'No way to prevent this,' says only package manager where this regularly happens
#92[deleted]
Re: 'No way to prevent this,' says only package manager where this regularly happens
#93I’m using nix for managing npm dependencies in a project and it seems like I accidentally got some protection from these attacks because of the nix sandbox.
Looks like I got more than I begged for.
Re: 'No way to prevent this,' says only package manager where this regularly happens
#94Earlier quoted context omitted.
Rust doesn’t have post install scripts
There is build.rs, proc macros are unsandboxed, and lastly you install the binary so that you can run it. Even if the build and install were fully sandboxed, the binary could still do malicious stuff if ran.
Yeah no shit, if you download malicious code from the internet and run it on your computer you will get pwned. No matter if it’s from a package manager a zip file or a submodule.
However the current npm vulns used a post install script.
Re: 'No way to prevent this,' says only package manager where this regularly happens
#95I know people have opinions about cooldowns, but they would have saved you from axios, tanstack, and many other recent npm supply chain attacks. If you have Artifactory / Nexus, you probably already have cooldowns, but it's easy to set up if you don't. Why cooldowns? Most npm (or pypi) compromises were taken down within hours, cooldowns simply mean - ignore any package with release date younger than N days (1 day can…
Seems like you dropped something:
> Disclaimer: I maintain depsguard
Re: 'No way to prevent this,' says only package manager where this regularly happens
#96Do not fucking use npm. Stay the fuck away from it. Want to write JS? AI can now write vanilla JS for you with no libraries. Own your code.
Re: 'No way to prevent this,' says only package manager where this regularly happens
#97There is no legitimate reason why postinstall scripts need to exist. The npm team needs to grow up and declare "starting with npm version whatever, npm will only run postinstall scripts for versions of packages published before ${today}".
With respect, post-install scripts are a total red herring. You're alarmed by them because they are code controlled by someone else that runs on your box, and they could do something bad -- yes, they are, and yes they could. But so is the regular code in those packages! It won't run at install time, but something in there will run -- otherwise it wouldn't have been included in the dependencies. Thinking that eliminat…
> There's a huge difference, because postinstall scripts are almost guaranteed to run in your CI pipeline. Compromised code probably won't (maybe it will if your test cases test a compromised package). Different attack profile. Worse in some ways (your CI likely has NPM push tokens, which is how this single-package worm become a multi-package self-replicating worm) (your CI pipeline also likely has some level of privileged access to your cloud environment; deployed services are more likely to be highly scoped). But, better in some ways.
Re: 'No way to prevent this,' says only package manager where this regularly happens
#98What are the actual guarantees that go/Rust make that Python/npm don’t? It seems like it might just be that Python/npm are juicier targets? I’m starting to try and avoid all third party packages
To be honest Rust has the exact same supply chain attack pattern - it's just newer and more maintained at the moment. Give it a decade.
Supply chain attacks are available to every language and framework that uses dependencies or modules you don’t control.
Re: 'No way to prevent this,' says only package manager where this regularly happens
#99What are the actual guarantees that go/Rust make that Python/npm don’t? It seems like it might just be that Python/npm are juicier targets? I’m starting to try and avoid all third party packages
To be honest Rust has the exact same supply chain attack pattern - it's just newer and more maintained at the moment. Give it a decade.
Programs in Rust (or almost every other language) normally have fewer dependencies by 2 or 3 orders of magnitude.
And that number tends to reduce even more when the ecosystem matures.
Re: 'No way to prevent this,' says only package manager where this regularly happens
#100With the recent high-profile attacks on PyPI packages, it’s no longer true that npm is the “only package manager where this regularly happens”. In fact, pip is much more dangerous than npm because it lacks a lockfile. uv fixes that, but adoption is proceeding at a snail’s pace.
[flagged]