3 ms·

What makes this problem so endemic to the Node community? I feel like I never hear about these types of scenarios with NuGet or other package managers. Not to s

by sylens 5y ago

What makes this problem so endemic to the Node community? I feel like I never hear about these types of scenarios with NuGet or other package managers. Not to say that it's not a problem elsewhere - it just seems like all the horror stories stem from NPM

geostyx 5y ago
I think it's partly because the JS ecosystem doesn't historically have a solid standard library. Doing simple things can require checking for null/undefined/does the runtime support it, etc. Why do it the hard way when you can NPM install it and call it a day? That's my understanding of it anyway.
- vimax 5y ago
  That and an aggressive auto update with lax version constraints for transitive dependencies leads to frequently downloading untrusted code.
- Jcampuzano2 5y ago
  The number of libraries reached for on your average JS app is humongous compared to basically any other programming language I've worked with, partially due to this. I think it's also just a footgun of the JS community. People tend to jump to "what package do I need to install for this" much quicker instead of thinking "how can I solve this". Every recent JS developer that is learning through online material is constantly berated with "just install this dep, and this dep, and then this one", to the point where it's normalized to have a dependency that comes with who knows what for something that could be a few lines of code and maybe some witty google-foo.
bretc 5y ago
Same reason most of the malware ecosystem focused on windows instead of macOS for many years. Scale of your potential target, and also volume of noise that is made when something bad happens. Also it supports nested dependencies and the tools can accommodate large deep trees without much pain, so they tend to grow in size over time.
- sylens 5y ago
  Is Node really that much more widepsread than dotnet, Java, or Python? Or is it more about the general experience level/knowledge of the typical JS developer, where it's more likely to have Bootcamp/self-taught experience than a formal CompSci education?
goodoldneon 5y ago
I think it's a combination of a relatively slim standard library and culture. For the culture part, JS devs seem to be more willing to install dependencies for basic functionality, rather that copy-pasting simple code into their projects. For example, `isobject` (https://www.npmjs.com/package/isobject https://www.npmjs.com/package/isobject) gets 55 million weekly downloads, but it's 3 lines of code
marwis 5y ago
Nuget has the same issue - it can execute arbitrary code during installation. Perhaps it's being exploited already but nobody noticed? Regardless, even in case of package managers that don't have install scripts (e.g. Maven) one could simply insert malware directly into library code and have it execute whenever you run tests or your application. The only true solution would be some sort of sophisticated sandboxing or sophisticated malware detection or distributed code review.

by sylens 5y ago

geostyx 5y ago

I think it's partly because the JS ecosystem doesn't historically have a solid standard library. Doing simple things can require checking for null/undefined/does the runtime support it, etc. Why do it the hard way when you can NPM install it and call it a day? That's my understanding of it anyway.

vimax 5y ago
That and an aggressive auto update with lax version constraints for transitive dependencies leads to frequently downloading untrusted code.
Jcampuzano2 5y ago
The number of libraries reached for on your average JS app is humongous compared to basically any other programming language I've worked with, partially due to this. I think it's also just a footgun of the JS community. People tend to jump to "what package do I need to install for this" much quicker instead of thinking "how can I solve this". Every recent JS developer that is learning through online material is constantly berated with "just install this dep, and this dep, and then this one", to the point where it's normalized to have a dependency that comes with who knows what for something that could be a few lines of code and maybe some witty google-foo.

bretc 5y ago

Same reason most of the malware ecosystem focused on windows instead of macOS for many years. Scale of your potential target, and also volume of noise that is made when something bad happens. Also it supports nested dependencies and the tools can accommodate large deep trees without much pain, so they tend to grow in size over time.

sylens 5y ago
Is Node really that much more widepsread than dotnet, Java, or Python? Or is it more about the general experience level/knowledge of the typical JS developer, where it's more likely to have Bootcamp/self-taught experience than a formal CompSci education?

goodoldneon 5y ago

I think it's a combination of a relatively slim standard library and culture. For the culture part, JS devs seem to be more willing to install dependencies for basic functionality, rather that copy-pasting simple code into their projects. For example, `isobject` (https://www.npmjs.com/package/isobject https://www.npmjs.com/package/isobject) gets 55 million weekly downloads, but it's 3 lines of code

marwis 5y ago

Nuget has the same issue - it can execute arbitrary code during installation. Perhaps it's being exploited already but nobody noticed? Regardless, even in case of package managers that don't have install scripts (e.g. Maven) one could simply insert malware directly into library code and have it execute whenever you run tests or your application. The only true solution would be some sort of sophisticated sandboxing or sophisticated malware detection or distributed code review.