Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

socket.dev

Post reply on HN
Print view View original

901–910 of 1001 posts

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#901

Post by chuckadams »

silverwind wrote: post #690
Liskni_si wrote: post #345

Earlier quoted context omitted.

> If npm respected every upstream lockfile, then it could never share a single version that satisfied all dependencies. I'm asking in the context of installing a single CLI tool into ~/bin or something. There's no requirement to satisfy all dependencies, because the only dependency I care about is that one CLI tool. All I want is an equivalent of what `cargo install --locked` does — use the top-level lockfile of the…

npm itself does not know that what you are installing is a CLI tool. Good CLI tools are bundled before release so they are zero-dependency as far as npm is concerned, which is ideal imho for all CLI tools, but many don't do that.

Looking for "type": "project" is about as close as npm gets to knowing whether something is a command, but lots of libraries do ship with utility commands. npx knows, since it's used for nothing but commands. I've never seen bundling used for anything I've installed through npm; that's more likely for standalone downloads and possibly things like homebrew.

I'll repeat that the bigger problem is that npm has such unfettered access to everything in the user account to begin with. FSM knows it's not strictly an npm problem, it's a Unix problem that's been there since the beginning, just that now, enough of the chickens are coming home to roost that people are starting to notice.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#902

Post by TylerE »

smaudet wrote: post #892
CaptainOfCoit wrote: post #888

Earlier quoted context omitted.

> External libraries are not for functionality that is used by most modern software. Where do you draw the line though? It seems like you mostly spend your time writing HTTP servers reading/writing JSON, but is that what everyone else also spends their time doing? You'll end up with a standard library weighing GBs, just because "most developers write HTTP servers", which doesn't sound like a better solution. I'm will…

I don't think things being libraries (modular) is at odds with a standard library. If you have a well vetted base library, that is frequently reviewed, under goes regular security and quality checks, then you should be minimally concerned about the quality of code that goes on top. In a well designed language, you can still export just what you need, or even replace parts of that standard library if you so choose. Th…

IMO Python 2 was rhetorical gold standard for getting the std lib right. Mostly batteries included, but not going totally insane with it.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#903

Post by Eisenstein »

TZubiri wrote: post #880
Eisenstein wrote: post #790

Earlier quoted context omitted.

Reductio ad Absurdum is not a fallacy but a legitimate rhetorical technique where you can point out obvious flaws in logic by taking that logic and applying it to something that people would find ridiculous. Note that this is not the most 'extreme' version, it is the same version, using the same logic. Example: Argument: People should be able to build whatever they want on their own property. Reductio ad Absurdum pos…

Just wanted to comment that chatgpt also wrongly categorizes this as reductio ad absurdum and strawman. This is very dead internet theory, but not automated, someone copied my comment, gave it to chatgpt, and returned the chatgpt answer, presumably passing it off as their own, but in effect we are talking with chatgpt lol.

It wouldn't be that annoying if it weren't wrong, I guess.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#904

Post by zelphirkalt »

user34283 wrote: post #872
zelphirkalt wrote: post #870

Earlier quoted context omitted.

My current project? Not sure what that has to do with the discussion, but my current project uses only a tiny bit of JS and has a fallback for users who don't run JS. It is a few pages taking a file to upload and the all the actual sauce is in the backend, and it is rendering templates. So I simply avoid the whole problem altogether in my current project. But aside from the JS stuff, the backend is in Python and I av…

So you're not using the npm ecosystem at all. Surely you see how that might be relevant to the discussion where you appeared to give advice on how to solve the npm dependency graph problem. That you're not using npm or other node package managers at all is the key information here. Not that it's invalid, but it's a very different setup.

It's not like I haven't worked on projects using NPM before ... Where I avoided adding dependencies willy-nilly. So trying to pin me on my current one project, disregarding any previous experience is quite a faulty argumentation, that doesn't invalidate anything I wrote.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#905

Post by JoBrad »

Arcterus wrote: post #891
silverliver wrote: post #871

Earlier quoted context omitted.

This is the right answer. I'm willing to stick my head out and assert that languages with a "minimal" standard library are defective by design. The argument of APIs being stuck is mood with approaches like Rust's epocs or "strict mode". Standard libraries should include everything needed to interact with modern systems. This means HTTP parsing, HTTP requests, and JSON parsing. Some laguages are excellent (like python…

> Standard libraries should include everything needed to interact with modern systems. This is great when the stdlib is well-designed and kept current when new standards and so on become available, but often "batteries included" approaches fail to cover all needs adequately, are slow to adopt new standards or introduce poorly designed modules that then cannot be easily changed, and/or fail to keep up-to-date with the…

The tradeoff of “batteries included” vs not is real: Python developers famously reach for community libraries like requests right away to avoid using the built-in tooling.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#906

Post by romaniv »

epage wrote: post #898
wvh wrote: post #823

Earlier quoted context omitted.

As a security guy, for years, you get laughed out of the room suggesting devs limit their dependencies and don't download half of the internet while building. You are an obstruction for making profit. And obviously reading the code does very little since modern (and especially Javascript) code just glues together frameworks and libraries, and there's no way a single human being is going to read a couple million lines…

This comes across as not being self-aware as to why security as laughed out of rooms: I read this as you correctly identifying some risks and said only offered the false-dichotomouy of solutions of "risk" and "no risk" without talking middle grounds between the two or finding third-ways that break the dichotomy. I could just be projecting my own bad experiences with "security" folks (in quotes as I can't speak to the…

I've been a web developer for over two decades. I have specific well-tested solutions for avoiding external JS dependencies. Despite that, I have the exact same experience as the above security guy. Most developers love adding dependencies.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#907

Post by CerebralCerb »

wvh wrote: post #823
kelnos wrote: post #405

As a user of npm-hosted packages in my own projects, I'm not really sure what to do to protect myself. It's not feasible for me to audit every single one of my dependencies, and every one of my dependencies' dependencies, and so on. Even if I had the time to do that, I'm not a typescript/javascript expert, and I'm certain there are a lot of obfuscated things that an attacker could do that I wouldn't realize was embed…

As a security guy, for years, you get laughed out of the room suggesting devs limit their dependencies and don't download half of the internet while building. You are an obstruction for making profit. And obviously reading the code does very little since modern (and especially Javascript) code just glues together frameworks and libraries, and there's no way a single human being is going to read a couple million lines…

The post you replied to suggested a real solution to the problem. It was implemented in my current org years ago (after log4j) and we have not been affected by any of the malware dependencies that has happened since.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#908

Post by user34283 »

zelphirkalt wrote: post #904
user34283 wrote: post #872

Earlier quoted context omitted.

So you're not using the npm ecosystem at all. Surely you see how that might be relevant to the discussion where you appeared to give advice on how to solve the npm dependency graph problem. That you're not using npm or other node package managers at all is the key information here. Not that it's invalid, but it's a very different setup.

It's not like I haven't worked on projects using NPM before ... Where I avoided adding dependencies willy-nilly. So trying to pin me on my current one project, disregarding any previous experience is quite a faulty argumentation, that doesn't invalidate anything I wrote.

Adding a single dependency on one popular package - such as Jest - can add 300 packages.

I am not convinced you ever checked how many packages were actually present in your projects, as you shared no specifics.

I assume you just did not check, and may have had hundreds of packages installed despite avoiding adding dependencies willy-nilly. This invalidates your suggestion.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#909

Post by whatever1 »

huem0n wrote: post #882
whatever1 wrote: post #875

Isn’t this a good case for LLMs? Audit at compile time all of the dependencies?

Please no, see > Using CVE reports as a weapon https://www.youtube.com/watch?v=GDdlRiThDeg

Oh you took it further, let the LLM take the wheel. I was just referring to the LLM raising a red flag during compilation. So worst case scenario it will just raise a false positive.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#910

Post by pier25 »

silverwind wrote: post #776
torben-friis wrote: post #122

I think these kinds of attack would be strongly reduced if js had a strong standard library. If it was provided, it would significantly trim dependency trees of all the small utility libraries. Perhaps we need a common community effort to create a “distro” of curated and safe dependencies one can install safely, by analyzing the most popular packages and checking what’s common and small enough to be worth being inclu…

Node.js has been adding APIs that make it feasible to write stuff without dependencies, it's slowly getting there.

What stuff?
Post reply on HN