Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

socket.dev

Post reply on HN
Print view View original

911–920 of 1001 posts

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#911

Post by user3939382 »

poly2it wrote: post #712
user3939382 wrote: post #182

Earlier quoted context omitted.

One upvote is not enough. We need enough upvotes to fix the problem. You can’t shape a big pile of shit into success. HTTP and JS will never serve as a proper application framework.

Would you care to elaborate? What solution do you propose, and how would it be implemented? How would removal of JavaScript and HTTP solve the dependency malware issue being discussed?

JS execution model and semantics naturally lend themselves to these huge dependency trees with easily obfuscated code. There are wider non-language specific strategies to really nail this problem but the language isn’t helping and at the same time is causing 1,000 other problems because it was designed to validate phone numbers in a text input.

I appreciate that HTTP sounds tangential but my point is the whole stack is designed wrong for what it’s doing and we waste all of our time commenting on and fixing the 1,000 manifestations of that rather just fix the architecture. There are political reasons for that I won’t get into.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#914

Post by Sophira »

AdamN wrote: post #893
user3939382 wrote: post #877

Earlier quoted context omitted.

I don’t recall hearing about constant supply chain attacks with CPAN

That was a different era. The velocity of change is 100x now and the expectation for public libraries to do common things is 100x higher as well.

Perl and CPAN are still a thing, much as people would like to think otherwise.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#915

Post by dec0dedab0de »

drdaeman wrote: post #515
CraftThatBlock wrote: post #413

Earlier quoted context omitted.

pnpm just added this: https://pnpm.io/blog/releases/10.16

This sounds nice in theory, but does it really solve the issue? I think that if no one's installing that package then no one is noticing the malware and no one is reporting that package either. It merely slightly improves the chances that author would notice a version they didn't release, but this doesn't work if author is not particularly actively working the compromised project.

a long enough delay would solve the issue for account takeovers, and bold attacks like this.

It would not solve for a bad actor gaining trust over years, then contributing seemingly innocent code that contains an exploitable bug with enough plausible deniability to remain on the team after it is patched.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#918

Post by pingust1 »

romaniv wrote: post #906
epage wrote: post #898

Earlier quoted context omitted.

This comes across as not being self-aware as to why security as laughed out of rooms: I read this as you correctly identifying some risks and said only offered the false-dichotomouy of solutions of "risk" and "no risk" without talking middle grounds between the two or finding third-ways that break the dichotomy. I could just be projecting my own bad experiences with "security" folks (in quotes as I can't speak to the…

I've been a web developer for over two decades. I have specific well-tested solutions for avoiding external JS dependencies. Despite that, I have the exact same experience as the above security guy. Most developers love adding dependencies.

[dead]

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#919

Post by user34283 »

wvh wrote: post #823
kelnos wrote: post #405

As a user of npm-hosted packages in my own projects, I'm not really sure what to do to protect myself. It's not feasible for me to audit every single one of my dependencies, and every one of my dependencies' dependencies, and so on. Even if I had the time to do that, I'm not a typescript/javascript expert, and I'm certain there are a lot of obfuscated things that an attacker could do that I wouldn't realize was embed…

As a security guy, for years, you get laughed out of the room suggesting devs limit their dependencies and don't download half of the internet while building. You are an obstruction for making profit. And obviously reading the code does very little since modern (and especially Javascript) code just glues together frameworks and libraries, and there's no way a single human being is going to read a couple million lines…

Your proposed solution does not work for web applications built with node packages.

Essentials tools such as Jest add 300 packages on their own.

You already have hundreds to thousands of packages installed, fretting over a few more for that DatePicker or something is pretty much a waste of time.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#920

Post by nerdponx »

What's stopping supply chain attacks like this from happening in other languages like Python, or even in source repos via compromised forge accounts like Github? Artifact/commit signing is optional, so while 2FA fortunately is becoming mandatory, if the maintainer never used signing then this could happen to PyPI just as well as NPM, no? Or is NPM uniquely vulnerable for some reason?
Post reply on HN