3 ms·

Using npm has never been secure, here is a fun little article about how someone used npm to inject malware into thousands of sites. https://hackernoon.com/im-ha

Using npm has never been secure, here is a fun little article about how someone used npm to inject malware into thousands of sites. https://hackernoon.com/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5 https://hackernoon.com/im-harvesting-credit-card-numbers-and...

nneonneo 8y ago
That’s a hypothetical piece (read it to the end), not the account of something that actually happened. Regardless, it still highlights the fact that everything is built on a rather fragile layer of trust.
- TooBrokeToBeg 8y ago
  NPM is still not secure. So dangerous, many companies run their own NPM repos with analyzed packages.
- da_chicken 8y ago
  I mean, there hasn't been anything as malicious as that, but... The left-pad issue [0] highlights how one developer can unpublish their code and result in breaking every package depended on that package. "Unpublish" can be substituted for anything from "unpublish" to "publish broken code" or "publish actively malicious code." Further, issues like the is-odd/is-even package popularity spike how developers can develop minimally beneficial encapsulation packages and then insert them into other packages as dependencies to pump up their numbers. [1] Well, what if someone's motivation wasn't to make their packages look important but to instead give them a way to inject code to all the locations (or maybe just one!) that run `npm update` or similar automatically on a daily basis. No, neither of these events that have actually happened are particularly malicious. On a scale of "excessive use of service" to "full network worm ransomware" they're somewhere around "suspiciously sketchy." But, the same problem can be exploited to cause real damage. Yeah, it very much reveals how fragile the web of trust in NPM is. I really do hate to keep posting these links, but people keep bringing NPM up where they're relevant! [0]: https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/ https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/ [1]: https://www.reddit.com/r/programming/comments/886zji/why_has_there_been_nearly_3_million_installs_of/ https://www.reddit.com/r/programming/comments/886zji/why_has...
  - Vinnl 8y ago
    > The left-pad issue [0] highlights how one developer can unpublish their code and result in breaking every package depended on that package. How they could unpublish their code. left-pad's specific issue is no longer allowed by npm and thus could not arise today. That's not to say other issues could not crop up, of course.
deleted 8y ago
[deleted]
latchkey 8y ago
In a similar vein, here is a fun issue I filed: https://github.com/npm/npm/issues/20072 https://github.com/npm/npm/issues/20072

nneonneo 8y ago

That’s a hypothetical piece (read it to the end), not the account of something that actually happened. Regardless, it still highlights the fact that everything is built on a rather fragile layer of trust.

TooBrokeToBeg 8y ago
NPM is still not secure. So dangerous, many companies run their own NPM repos with analyzed packages.
da_chicken 8y ago
I mean, there hasn't been anything as malicious as that, but... The left-pad issue [0] highlights how one developer can unpublish their code and result in breaking every package depended on that package. "Unpublish" can be substituted for anything from "unpublish" to "publish broken code" or "publish actively malicious code." Further, issues like the is-odd/is-even package popularity spike how developers can develop minimally beneficial encapsulation packages and then insert them into other packages as dependencies to pump up their numbers. [1] Well, what if someone's motivation wasn't to make their packages look important but to instead give them a way to inject code to all the locations (or maybe just one!) that run `npm update` or similar automatically on a daily basis. No, neither of these events that have actually happened are particularly malicious. On a scale of "excessive use of service" to "full network worm ransomware" they're somewhere around "suspiciously sketchy." But, the same problem can be exploited to cause real damage. Yeah, it very much reveals how fragile the web of trust in NPM is. I really do hate to keep posting these links, but people keep bringing NPM up where they're relevant! [0]: https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/ https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/ [1]: https://www.reddit.com/r/programming/comments/886zji/why_has_there_been_nearly_3_million_installs_of/ https://www.reddit.com/r/programming/comments/886zji/why_has...
- Vinnl 8y ago
  > The left-pad issue [0] highlights how one developer can unpublish their code and result in breaking every package depended on that package. How they could unpublish their code. left-pad's specific issue is no longer allowed by npm and thus could not arise today. That's not to say other issues could not crop up, of course.

deleted 8y ago

[deleted]

latchkey 8y ago

In a similar vein, here is a fun issue I filed: https://github.com/npm/npm/issues/20072 https://github.com/npm/npm/issues/20072