5 ms·

"The attack was carried out by using a pattern that is becoming more and more popular; publishing a ‘useful’ package (electron-native-notify) to npm, waiting un

"The attack was carried out by using a pattern that is becoming more and more popular; publishing a ‘useful’ package (electron-native-notify) to npm, waiting until it was in use by the target, and then updating it to include a malicious payload." Gary Bernhardt has an interesting comment: https://twitter.com/garybernhardt/status/1137459482135416832 https://twitter.com/garybernhardt/status/1137459482135416832

cortesoft 7y ago
Yeah, the fact that a pull request to add a dependency that did so little went through unchallenged is the real scary part.
zaphirplane 7y ago
I dont see what’s special about npm compared to pip, gem, nuget, maven as tools
jw1224 7y ago
re: Bernhardt's tweet — > This is exactly what many of us predicted when NPM introduced a world of thousands of separate dependencies per app. The main reactions to that skepticism were "stop being so negative" and "don't try to stop progress." I'm sure "many of us" predicted planes would crash when they first took flight, but nonetheless the benefits of commercial air travel vastly outweigh the risks. npm, having been a huge benefit to developers and the JS ecosystem for many years, should not have its problems dismissed with an "I told you so" attitude.
- drngdds 7y ago
  The problems with the JS ecosystem probably could have been solved in a way that doesn't involve every nontrivial project dynamically downloading thousands of transitive dependencies by god-knows-who. It's not like package repositories and dependency management were uncharted waters before npm came along.
  - dboreham 7y ago
    But "this one goes to eleven".
    - krapp 7y ago
      You mean it goes to 10.9999999998
a-nikolaev 7y ago
https://hackernoon.com/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5 https://hackernoon.com/im-harvesting-credit-card-numbers-and... -- nice story linked in his thread
- NetOpWibby 7y ago
  Well that was terrifying.
jeffdavis 7y ago
Not entirely fair to npm. The battle is software complexity in general. Perhaps npm made the problem worse, but they hardly started it.
stock_toaster 7y ago
And with github's recent "automatically create dep update PR" feature for security notifications, it would presumably be even easier to get people to update to a malicious version. Just claim the old version had a security vulnerability!

cortesoft 7y ago

Yeah, the fact that a pull request to add a dependency that did so little went through unchallenged is the real scary part.

zaphirplane 7y ago

I dont see what’s special about npm compared to pip, gem, nuget, maven as tools

jw1224 7y ago

re: Bernhardt's tweet — > This is exactly what many of us predicted when NPM introduced a world of thousands of separate dependencies per app. The main reactions to that skepticism were "stop being so negative" and "don't try to stop progress." I'm sure "many of us" predicted planes would crash when they first took flight, but nonetheless the benefits of commercial air travel vastly outweigh the risks. npm, having been a huge benefit to developers and the JS ecosystem for many years, should not have its problems dismissed with an "I told you so" attitude.

drngdds 7y ago
The problems with the JS ecosystem probably could have been solved in a way that doesn't involve every nontrivial project dynamically downloading thousands of transitive dependencies by god-knows-who. It's not like package repositories and dependency management were uncharted waters before npm came along.
- dboreham 7y ago
  But "this one goes to eleven".
  - krapp 7y ago
    You mean it goes to 10.9999999998

a-nikolaev 7y ago

https://hackernoon.com/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5 https://hackernoon.com/im-harvesting-credit-card-numbers-and... -- nice story linked in his thread

NetOpWibby 7y ago
Well that was terrifying.

jeffdavis 7y ago

Not entirely fair to npm. The battle is software complexity in general. Perhaps npm made the problem worse, but they hardly started it.

stock_toaster 7y ago

And with github's recent "automatically create dep update PR" feature for security notifications, it would presumably be even easier to get people to update to a malicious version. Just claim the old version had a security vulnerability!