Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

socket.dev

Post reply on HN
Print view View original

931–940 of 1001 posts

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#931

Post by ivan_gammel »

Ygg2 wrote: post #890
silverliver wrote: post #871

Earlier quoted context omitted.

This is the right answer. I'm willing to stick my head out and assert that languages with a "minimal" standard library are defective by design. The argument of APIs being stuck is mood with approaches like Rust's epocs or "strict mode". Standard libraries should include everything needed to interact with modern systems. This means HTTP parsing, HTTP requests, and JSON parsing. Some laguages are excellent (like python…

> Standard libraries should include everything needed to interact with modern systems. So, databases? Which then begs the question, which - Postgres, MySQL, SQLite, MS SQL, etc.? And some NoSQL, because modern systems might need it. That basically means you need to pull in everything and the kitchen sink. And freeze it in time (because of backwards compatibility). HTML, HTTP parsing, and SHA1024 are perfectly reasona…

It is not madness. Java is a good example of rich and modular standard library. Some components of it are eventually deprecated and removed (e.g. Applets) and this process takes long enough. Its standard library does include good crypto and http client, database abstraction API (JDBC) which is implemented by database drivers etc.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#933

Post by Aperocky »

rpodraza wrote: post #932

Someone should eradicate the npm ecosystem and start from scratch. No sane package manager would allow to run arbitrary scripts or download stuff from God knows where, like random github repos.

npm is now a private company right? It does also look like they have already gone through enshittification and don't even seem to have publicly acknowledged this attack.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#934

Post by electrotype »

silverwind wrote: post #700
AndreasHae wrote: post #596

Earlier quoted context omitted.

It’s still ridiculous to me that version pinning isn’t the default for npm. The first thing I do for all of my projects is adding a .npmrc with save-exact=true

save-exact is mostly useless against such attacks because it only works on direct dependencies.

Why, though?

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#935

Post by pjmlp »

silverliver wrote: post #871
999900000999 wrote: post #866

Earlier quoted context omitted.

The "solution" would be using a language with a strong standard library and then having a trusted 3rd party manually audit any approved packages. THEN use artifactory on top of that. That's boring and slow though. Whatever I want my packages and I want them now. Apart of the issue is the whole industry is built upon goodwill and hope. Some 19 year old hacked together a new front end framework last week, better use it…

This is the right answer. I'm willing to stick my head out and assert that languages with a "minimal" standard library are defective by design. The argument of APIs being stuck is mood with approaches like Rust's epocs or "strict mode". Standard libraries should include everything needed to interact with modern systems. This means HTTP parsing, HTTP requests, and JSON parsing. Some laguages are excellent (like python…

Spot on, I rather have a Python, Java,.NET,.. standard library, that may have a few warts, but works everywhere there is full compliant implementation, than playing lego, with libraries that might not even support all platforms, and be more easily open to such attacks.

Is java.util.logging.Logger not that great?

Sure, yet everyone that used it had a good night rest when Log4J exploit came to be.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#936

Post by pjmlp »

999900000999 wrote: post #923
silverliver wrote: post #871

Earlier quoted context omitted.

This is the right answer. I'm willing to stick my head out and assert that languages with a "minimal" standard library are defective by design. The argument of APIs being stuck is mood with approaches like Rust's epocs or "strict mode". Standard libraries should include everything needed to interact with modern systems. This means HTTP parsing, HTTP requests, and JSON parsing. Some laguages are excellent (like python…

It's not an easy problem to solve. Doing it the right way would create friction, developers might need to actually understand what the code is doing rather than pulling in random libraries. Try explaining to your CTO that development will slow down to verify the entire dependency chain. I'm more thinking C# or Java. If Microsoft or Oracle is providing a library you can hope it's safe. You *could* have a development e…

Why?

This is a standard practice in most places I have worked, CI/CD only allowed to use internal repos, and libraries are only added after clearance.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#937

Post by awaythrow999 »

wvh wrote: post #823
kelnos wrote: post #405

As a user of npm-hosted packages in my own projects, I'm not really sure what to do to protect myself. It's not feasible for me to audit every single one of my dependencies, and every one of my dependencies' dependencies, and so on. Even if I had the time to do that, I'm not a typescript/javascript expert, and I'm certain there are a lot of obfuscated things that an attacker could do that I wouldn't realize was embed…

As a security guy, for years, you get laughed out of the room suggesting devs limit their dependencies and don't download half of the internet while building. You are an obstruction for making profit. And obviously reading the code does very little since modern (and especially Javascript) code just glues together frameworks and libraries, and there's no way a single human being is going to read a couple million lines…

Agree on the only solution being reducing dependencies.

Even more weird in the EU where things like Cyber Resilience Act mandate patching publicly known vulnerabilities. Cool, so let's just stay up2date? Supply-chain vuln goes Brrrrrr

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#938

Post by Aldipower »

kelnos wrote: post #405

As a user of npm-hosted packages in my own projects, I'm not really sure what to do to protect myself. It's not feasible for me to audit every single one of my dependencies, and every one of my dependencies' dependencies, and so on. Even if I had the time to do that, I'm not a typescript/javascript expert, and I'm certain there are a lot of obfuscated things that an attacker could do that I wouldn't realize was embed…

You can use Sonatype or Artifactory as an self-hosted provider for your NPM packages that keep their own NPM repository. This way you can delay and control updates. It is common enterprise practice.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#939

Post by Yasuraka »

ForHackernews wrote: post #821
Yasuraka wrote: post #757

Earlier quoted context omitted.

So GitHub is every single programming language's centralized package repository? Then what's the difference between git and npm, cargo, pypi, mvn et al?

Git != Github. In practice, little difference between Go's use of Github and Python's use of PyPI. Someone at Microsoft with root access could compromise everyone.

> Git != Github

That's why I'm putting emphasis on it, because to Go it is.

And to languages that actually have centralized package repositories it isn't. There is a difference between code and packages and Go simply does not have the latter (in the traditional sense - what Go calls a package is a collection of source files in the same directory that are compiled together within a module (a module is a collection of packages (again, code) that are released, versioned, and distributed together. Modules may be downloaded directly from version control repositories or via proxy servers)).

To the other languages mentioned above, packages may have binaries, metadata and special script hooks. There is a package manager like pip , cargo or npm and if you want to install one, you won't have to specify a URL because there is a canonical domain to go to.

Go just knows code and it'll use git, hg or even svn. And if you want to claim that lots of open-source code being on GitHub makes it special, then

> GitHub is every single programming language's centralized package repository

and

> Someone at Microsoft with root access could compromise every user of every single programming language

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#940

Post by WorldMaker »

user34283 wrote: post #855
WorldMaker wrote: post #297

Earlier quoted context omitted.

- I feel that you are unlikely to need Babel in 2025, most things it historically transpiled are Baseline Widely Available now (and most of the things it polyfilled weren't actually Babel's but brought in from other dependencies like core-js, which you probably don't need either in 2025). For the rest of the things it still transpiles (pretty much just JSX) there are cheaper/faster transpilers with fewer external dep…

Jest alone adds 300 packages by the way.

Yep, which is part of why it feels real good to delete Jest and switch to `node --test`. I realize for a lot of projects that is easier said than done because Jest isn't just the test harness but the assertions framework (`node:assert/strict` isn't terrible; Chai is still a good low-dependency option for fancier styles of assertions) and mocks/substitutes framework (I'm sure there are options there; I never liked Jest's style of mocks so I don't have a recommendation handy).

(ETA: Also, you may not need much for a mocks library because JS' Proxy meta-object isn't that hard to work with directly.)

Post reply on HN