Pnpm has a new setting to stave off supply chain attacks
1–10 of 152 posts
Re: Pnpm has a new setting to stave off supply chain attacks
#2If everyone is going to wait 3 days before installing the latest version of a compromised package, it will take more than 3 days to detect an incident.
Re: Pnpm has a new setting to stave off supply chain attacks
#3If everyone is going to wait 3 days before installing the latest version of a compromised package, it will take more than 3 days to detect an incident.
A lot of people will still use npm, so they'll be the canaries in the coal mine :)
More seriously, automated scanners seem to do a good job already of finding malicious packages. It's a wonder that npm themselves haven't already deployed an automated countermeasure.
Re: Pnpm has a new setting to stave off supply chain attacks
#4Should have included the units in the name or required a choice of unit to be selected as part of the value. Sorry, just a bugbear of mine.
Re: Pnpm has a new setting to stave off supply chain attacks
#5Should have included the units in the name or required a choice of unit to be selected as part of the value. Sorry, just a bugbear of mine.
Or just use ISO8601 standard notation (e.g. "P1D" for one day)
Re: Pnpm has a new setting to stave off supply chain attacks
#6I have a question: when I’ve seen people discussing this setting, people talk about using like ”3 days” or ”7 days” as the timeout, which seems insanely short to me for production use. As a C++ developer, I would be hesitant to use any dependency in the first six months of release in production, unless there’s some critical CVE or something (then again, we make client side applications with essentially no networking, so security isn’t as critical for us, stability is much more important).
Does the JS ecosystem really move so fast that you can’t wait a month or two before updating your packages?
Re: Pnpm has a new setting to stave off supply chain attacks
#7Should have included the units in the name or required a choice of unit to be selected as part of the value. Sorry, just a bugbear of mine.
ISO8601 durations should be used, like PT3M.
Re: Pnpm has a new setting to stave off supply chain attacks
#8If everyone is going to wait 3 days before installing the latest version of a compromised package, it will take more than 3 days to detect an incident.
A lot of people will still use npm, so they'll be the canaries in the coal mine :) More seriously, automated scanners seem to do a good job already of finding malicious packages. It's a wonder that npm themselves haven't already deployed an automated countermeasure.
If only there was a high-ranking official at Microsoft, who could prioritize security[1]! /s
[1] https://blogs.microsoft.com/blog/2024/05/03/prioritizing-sec...
Re: Pnpm has a new setting to stave off supply chain attacks
#9That solve not really the problem.
A better (not perfect) solution: Every package should by AI analysed on an update before it is public available, to detect dangerous code and set a rating.
In package.json should be a rating defined, when remote package is below that value it could be updated, if it is higher a warning should appear.
But this will cost, but i hope, that companies like github, etc. will allow package-Repositories to use their services for free. Or we should find a way, to distribute this services to us (the users and devs) like a BOINC-Client.
Re: Pnpm has a new setting to stave off supply chain attacks
#10That solve not really the problem. A better (not perfect) solution: Every package should by AI analysed on an update before it is public available, to detect dangerous code and set a rating. In package.json should be a rating defined, when remote package is below that value it could be updated, if it is higher a warning should appear. But this will cost, but i hope, that companies like github, etc. will allow package…
Ah, yes! The universal and uncheatable LLM! Surely nothing can go wrong.