4 ms·

Great article. The JS ecosystem/supply chain scares me. 94% of all active repos on GitHub rely on Javascript (according to the 2020 state of the octoverse repor

Great article. The JS ecosystem/supply chain scares me. 94% of all active repos on GitHub rely on Javascript (according to the 2020 state of the octoverse report). There is a lot of motivation for black hats to insert Bitcoin miners into semi-popular npm packages so they can fly under the radar. Scary times.

aigo 5y ago
Can I ask, is the Node ecosystem different in this respect to PyPI for example? Or is it not different at all and the same thing could (does?) happen there too?
- c0wb0yc0d3r 5y ago
  I'm not sure what countermeasures that project has in place, but there are plenty of articles exploring malicious packages found there.
- bscphil 5y ago
  They're really quite different in my experience, but the difference is not one of availability so much as it is Python developers (mostly) following traditional software engineering best practices. I write almost all my hobby projects in Python. Very rarely do I incur a dependency tree involving more than a dozen projects while doing so. The rm -rf vulnerability is essentially a problem with a chain only being as strong as its weakest link. If any of the maintainers in the hundreds of node dependencies your project uses is malevolent, you're screwed. Hence, the security of the chain depends much more on the number of links it has rather than its innate strength. Even large and complex dependencies tend to be well engineered in Python. BeautifulSoup is a widely used library for loosely parsing HTML. It requires only Python and an internal library. lxml is another HTML parser (which BS can optionally use), and it requires only Python and a couple of C libraries. Even an entire web framework (Flask) uses only 4 Python dependencies directly and only one of these (the Jinja template engine) has recursive dependencies on other Python packages. All told it's about 10 Python packages needed in total. Or consider this, if you want an example of a trivial command line tool: the Python tldr[1] client uses only 3 libraries as recursive dependencies. The Rust client, tealdeer, has 119. The official nodejs client has, if I'm counting correctly, 603. [1] https://tldr.sh/ https://tldr.sh/
  - aigo 5y ago
    Thanks for this.
tekstar 5y ago
Not sure about pypi but any non-trivial node app has exponentially more package dependencies compared to a similar sized ruby or go app, due to a combination of the "micropackage" fad and the language is a bit of a fragmented mess with a not great standard library. You end up with a lot of polyfills, normalization, and helper functions that are wrapped as their own library. That's my experience, anyways, having previously worked on a large rails application, as well as large golang applications, and now spending most of my time in a typescript project.
- qudat 5y ago
  It's not really a fad as much as a selection pressure. I wrote an article about it because there is a lot of confusion about why one-line npm packages are popular: https://erock.io/2021/03/27/my-love-letter-to-front-end-web-development.html https://erock.io/2021/03/27/my-love-letter-to-front-end-web-...
  - wutbrodo 5y ago
    I may have missed it, but I didn't see any explanation in that article of why anyone would depend on something like leftpad instead of just writing the single LoC directly into their application.
deckard1 5y ago
JS land is a total shitshow, that's a given. But this sort of thing happens quite often outside NPM as well. If you're an author of a popular web browser extension then you've probably received emails from random shady people offering to buy your extension. And of course, some people are offered a sum they can't refuse. Google and Apple app stores aren't immune from this either. I just remembered the absolute saddest hijacking I ever witnessed. It was this blog I read one day. The guy had some interesting articles (business, I believe). I kept reading and he starts talking about his health. It gets worse and worse. Then suddenly the tone of the articles change. I notice weird links to vitamin and supplement crap stuck in articles that had nothing to do with it. The articles became incredibly generic. So I did some research. Turns out, the guy died from cancer, apparently his domain name expired, and some SEO spammer type took his domain and his content and repurposed it for shitty harvesting purposes.

aigo 5y ago

Can I ask, is the Node ecosystem different in this respect to PyPI for example? Or is it not different at all and the same thing could (does?) happen there too?

c0wb0yc0d3r 5y ago
I'm not sure what countermeasures that project has in place, but there are plenty of articles exploring malicious packages found there.
bscphil 5y ago
They're really quite different in my experience, but the difference is not one of availability so much as it is Python developers (mostly) following traditional software engineering best practices. I write almost all my hobby projects in Python. Very rarely do I incur a dependency tree involving more than a dozen projects while doing so. The rm -rf vulnerability is essentially a problem with a chain only being as strong as its weakest link. If any of the maintainers in the hundreds of node dependencies your project uses is malevolent, you're screwed. Hence, the security of the chain depends much more on the number of links it has rather than its innate strength. Even large and complex dependencies tend to be well engineered in Python. BeautifulSoup is a widely used library for loosely parsing HTML. It requires only Python and an internal library. lxml is another HTML parser (which BS can optionally use), and it requires only Python and a couple of C libraries. Even an entire web framework (Flask) uses only 4 Python dependencies directly and only one of these (the Jinja template engine) has recursive dependencies on other Python packages. All told it's about 10 Python packages needed in total. Or consider this, if you want an example of a trivial command line tool: the Python tldr[1] client uses only 3 libraries as recursive dependencies. The Rust client, tealdeer, has 119. The official nodejs client has, if I'm counting correctly, 603. [1] https://tldr.sh/ https://tldr.sh/
- aigo 5y ago
  Thanks for this.

tekstar 5y ago

Not sure about pypi but any non-trivial node app has exponentially more package dependencies compared to a similar sized ruby or go app, due to a combination of the "micropackage" fad and the language is a bit of a fragmented mess with a not great standard library. You end up with a lot of polyfills, normalization, and helper functions that are wrapped as their own library. That's my experience, anyways, having previously worked on a large rails application, as well as large golang applications, and now spending most of my time in a typescript project.

qudat 5y ago
It's not really a fad as much as a selection pressure. I wrote an article about it because there is a lot of confusion about why one-line npm packages are popular: https://erock.io/2021/03/27/my-love-letter-to-front-end-web-development.html https://erock.io/2021/03/27/my-love-letter-to-front-end-web-...
- wutbrodo 5y ago
  I may have missed it, but I didn't see any explanation in that article of why anyone would depend on something like leftpad instead of just writing the single LoC directly into their application.

deckard1 5y ago

JS land is a total shitshow, that's a given. But this sort of thing happens quite often outside NPM as well. If you're an author of a popular web browser extension then you've probably received emails from random shady people offering to buy your extension. And of course, some people are offered a sum they can't refuse. Google and Apple app stores aren't immune from this either. I just remembered the absolute saddest hijacking I ever witnessed. It was this blog I read one day. The guy had some interesting articles (business, I believe). I kept reading and he starts talking about his health. It gets worse and worse. Then suddenly the tone of the articles change. I notice weird links to vitamin and supplement crap stuck in articles that had nothing to do with it. The articles became incredibly generic. So I did some research. Turns out, the guy died from cancer, apparently his domain name expired, and some SEO spammer type took his domain and his content and repurposed it for shitty harvesting purposes.