5 ms·

NPM is extremely vulnerable to typosquatting. Be cautious with what you install. The install scripts can execute arbitrary code. NPM's team response is that the

by nukeop 9y ago

NPM is extremely vulnerable to typosquatting. Be cautious with what you install. The install scripts can execute arbitrary code. NPM's team response is that they hope that malicious actor won't exploit this behaviour. According to my tests, typosquatting 3 popular packages allows to take over around 200 computers in 2 weeks time it takes their moderators to notice it.

swang 9y ago
this is not a response? http://blog.npmjs.org/post/168978377570/new-package-moniker-rules http://blog.npmjs.org/post/168978377570/new-package-moniker-...
- hateduser2 9y ago
  Why assume they’ve already seen it? They probably just haven’t
- nukeop 9y ago
  That's okay, but it's not enough - it's easy to swap two letters and do similar substitutions to fool many users. If a package is downloaded 10,000 times every day, surely once in a while someone will misspell the name somehow. Other than that, their reaction to similar incidents was to wait for somebdoy on twitter to notify them, ban the responsible users, and hope that it won't happen again. It's still extremely exploitable and there are surely many other novel ways of installing malware using the repository that we haven't even heard of yet. The NPM security team is slow to act and sadly doesn't think ahead. They're responsible for one of the largest software ecosystems in the world, they should step up their game.
  - eropple 9y ago
    Yup. The best answer I can come up with given their constraints (some self-imposed) is to force all new packages to be scoped.
    - johnny22 9y ago
      how many typosquats on scope names will there be I wonder.
  - Rapzid 9y ago
    They could(should?) implement edit distance checks on all new packages against existing packages. If the name is too similar to an existing package name it requires approval.
corndoge 9y ago
typical JavaScript engineering
- nukeop 9y ago
  Javascript is a very handy language, it's held back by all the gymnastics it needs to do to get over browser/www limitations, and an influx of low skill developers with no diploma.
  - valuearb 9y ago
    Hey, I’ve got no diploma, just 30 years of commercial development. But even I know that all the unit tests in the world can’t paper over the flaws of a typeless scripting language.
  - reificator 9y ago
    Would you rather they be low skill developers with a diploma?
  - dadvader 9y ago
    > it's held back by all the gymnastics it needs to do to get over browser/www limitations, I suppose, but I think it's the javascript "nature" ( dynamic typing along with the scripting style of wanting to be a "swiss knife" to solve all problems ). Javascript, like perl and even C, gives you a lot of rope to hang yourself. And like perl and C, javascript initially seems simple and easy and it deceives you into thinking novices know what they are doing. > and an influx of low skill developers with no diploma. That's true of all languages though. Plenty of incompetent developers at all levels and all languages. I don't think it's a javascript issue.
    - tonyarkles 9y ago
      > Plenty of incompetent developers at all levels and all languages. I don't think it's a javascript issue. While that's potentially true, I do suspect that there's a lot fewer, say, Haskell, Clojure, or Elixir developers than there are for some other languages. Not that they don't exist, but it seems unlikely that you'd cross paths with them.

by nukeop 9y ago

swang 9y ago

this is not a response? http://blog.npmjs.org/post/168978377570/new-package-moniker-rules http://blog.npmjs.org/post/168978377570/new-package-moniker-...

hateduser2 9y ago
Why assume they’ve already seen it? They probably just haven’t
nukeop 9y ago
That's okay, but it's not enough - it's easy to swap two letters and do similar substitutions to fool many users. If a package is downloaded 10,000 times every day, surely once in a while someone will misspell the name somehow. Other than that, their reaction to similar incidents was to wait for somebdoy on twitter to notify them, ban the responsible users, and hope that it won't happen again. It's still extremely exploitable and there are surely many other novel ways of installing malware using the repository that we haven't even heard of yet. The NPM security team is slow to act and sadly doesn't think ahead. They're responsible for one of the largest software ecosystems in the world, they should step up their game.
- eropple 9y ago
  Yup. The best answer I can come up with given their constraints (some self-imposed) is to force all new packages to be scoped.
  - johnny22 9y ago
    how many typosquats on scope names will there be I wonder.
- Rapzid 9y ago
  They could(should?) implement edit distance checks on all new packages against existing packages. If the name is too similar to an existing package name it requires approval.

corndoge 9y ago

typical JavaScript engineering

nukeop 9y ago
Javascript is a very handy language, it's held back by all the gymnastics it needs to do to get over browser/www limitations, and an influx of low skill developers with no diploma.
- valuearb 9y ago
  Hey, I’ve got no diploma, just 30 years of commercial development. But even I know that all the unit tests in the world can’t paper over the flaws of a typeless scripting language.
- reificator 9y ago
  Would you rather they be low skill developers with a diploma?
- dadvader 9y ago
  > it's held back by all the gymnastics it needs to do to get over browser/www limitations, I suppose, but I think it's the javascript "nature" ( dynamic typing along with the scripting style of wanting to be a "swiss knife" to solve all problems ). Javascript, like perl and even C, gives you a lot of rope to hang yourself. And like perl and C, javascript initially seems simple and easy and it deceives you into thinking novices know what they are doing. > and an influx of low skill developers with no diploma. That's true of all languages though. Plenty of incompetent developers at all levels and all languages. I don't think it's a javascript issue.
  - tonyarkles 9y ago
    > Plenty of incompetent developers at all levels and all languages. I don't think it's a javascript issue. While that's potentially true, I do suspect that there's a lot fewer, say, Haskell, Clojure, or Elixir developers than there are for some other languages. Not that they don't exist, but it seems unlikely that you'd cross paths with them.