3 ms·

This attack has been previously described in the paper "Typosquatting package managers": Paper: http://incolumitas.com/data/thesis.pdf http://incolumitas.com/d

This attack has been previously described in the paper "Typosquatting package managers": Paper: http://incolumitas.com/data/thesis.pdf http://incolumitas.com/data/thesis.pdf Blog post: http://incolumitas.com/2016/06/08/typosquatting-package-managers/ http://incolumitas.com/2016/06/08/typosquatting-package-mana... Discussion: https://news.ycombinator.com/item?id=11862217 https://news.ycombinator.com/item?id=11862217 https://www.reddit.com/r/netsec/comments/4n4w2h/ https://www.reddit.com/r/netsec/comments/4n4w2h/ The paper also discusses possible mitigation measures, including prohibiting registering new packages within a certain Levenshtein distance of existing packages and using additional namespacing.

hueving 9y ago
Not really different from any other typo-squatting (e.g. domains).
- db48x 9y ago
  Except that in this case you're installing software on your computer, not just visiting a webpage.
  - boramalper 9y ago
    You might also be downloading the software from a webpage. ;)
    - pilif 9y ago
      That would still be a two-step process (downloading from the browser and then manually executing it). `npm install` runs code as part of the initial step. Also, `npm install foo` will of course not just run code from `foo` but from all its dependencies and their dependencies dependencies as well.
micaksica 9y ago
Thanks, I came here to post this exact thing. Even if NPM isn't prohibiting packages, you'd imagine they'd have internal security alerting for Levenshtein distance from the names of very popular npm packages. Such an alerting script wouldn't take terribly long to write (or to run). It'd let them catch this type of abuse much faster even if they decided (for some inane reason) that banning the names outright would break UX.
codedokode 9y ago
Typosquatting can be prevented by premoderation in the repository.
joshfraser 9y ago
You can't assume that the original developer will be the first person to post their package. For example, I published some code on my blog long before NPM was a thing. Today that code gets 10k downloads a month on NPM but I had nothing to do w/ publishing it on NPM and haven't audited it for changes.

hueving 9y ago

Not really different from any other typo-squatting (e.g. domains).

db48x 9y ago
Except that in this case you're installing software on your computer, not just visiting a webpage.
- boramalper 9y ago
  You might also be downloading the software from a webpage. ;)
  - pilif 9y ago
    That would still be a two-step process (downloading from the browser and then manually executing it). `npm install` runs code as part of the initial step. Also, `npm install foo` will of course not just run code from `foo` but from all its dependencies and their dependencies dependencies as well.

micaksica 9y ago

Thanks, I came here to post this exact thing. Even if NPM isn't prohibiting packages, you'd imagine they'd have internal security alerting for Levenshtein distance from the names of very popular npm packages. Such an alerting script wouldn't take terribly long to write (or to run). It'd let them catch this type of abuse much faster even if they decided (for some inane reason) that banning the names outright would break UX.

codedokode 9y ago

Typosquatting can be prevented by premoderation in the repository.

joshfraser 9y ago

You can't assume that the original developer will be the first person to post their package. For example, I published some code on my blog long before NPM was a thing. Today that code gets 10k downloads a month on NPM but I had nothing to do w/ publishing it on NPM and haven't audited it for changes.