15 ms·
NPM package event-source-polyfill compromised by political activists
- ramesh31 5y agoI was digging through node_modules today and almost had a heart attack. We are running this code across millions of users right now.
- throw_m239339 5y agoDid you ever audit the code in that package or read the source at least once?
- hatware 5y agoGood question, I'd love to see an honest answer...
- Alcha 5y agoI feel like this question has good intentions but comes across wrong. It's virtually impossible to audit literally every nested dependency.
- yjftsjthsd-h 5y agoIf nobody can audit the dependency tree, should you really be using it?
- adamscybot 5y ago"Depends". The benefits of leaning on open source pays off the majority of the time. Are you exposed to more risk? Yes. Does that mean you shouldnt take that risk? Not really. Otherwise you'd struggle to move quickly and be competitive. Of course certain things change this balance. Hopefully nuclear power plants dont have NPM in their toolchain. And I believe financial orgs already have quite heavy auditing of dependencies.
- exfascist 5y agoOpen source and large dependency trees are orthogonal. You can depend on closed modules in compiled languages, many people do. You can write open source software and only depend on the standard library, many people do.
- the8472 5y agoDepends on how much the company values (i.e. is paying for) that supply chain security. And if enough companies cared they could even save money by pooling efforts.
- pabs3 5y agoThe crev folks aim to create a tool to allow that pooling: https://github.com/crev-dev/ https://github.com/crev-dev/
- megous 5y agoIt's literally possible. You just have to have that as a goal from the start of the project. I just looked at our call center product. Across frontend and backend we have 70 npm dependencies required for build/runtime. Most are small. It's not that hard to do some superficial review once and do a diff of node_modules when updating npm-shrinkwrap.json for whatever reason. It's utterly irresponsible to not do so when pulling code from untrusted sources like npm. Don't pull in dependencies which have many dependencies themselves. There are many projects that pride itself on minimalism and lack of transitive dependencies. Choose those. Etc.
- jackconsidine 5y agoThat's a tremendous expectation. There are 913 node_modules in the first project I glanced at. That's millions of lines of code.... More than one person can reasonably audit even if it's their full-time job. Where would this responsibility end? Should they also be auditing Node.JS source code? And nightly browser builds? No, we necessarily federate our trust at some point in these things being raised by others (like now, albeit 23 days late).
- exfascist 5y agoI don't run nigtly browser builds because that's too much to keep up with. I have actually read quite a bit of the code for the browser I use. I read almost everything I deploy because I'm responsible for it. Using other people's code absolves you from maintenance but not responsibility, that's something people need to start understanding. It's a very reasonable expectation that you read through your dependencies, if it's too much then it's time to trim some fat.
- pabs3 5y agoThere is a distributed code review system that is intended to make it feasible to do the necessary review: https://github.com/crev-dev/ https://github.com/crev-dev/
- JohnHaugeland 5y agoIt seems like you're attempting to suggest that third party javascript is on equal trust footing with major tools and things by international corporations
- jackconsidine 5y agoMy point was that it's unreasonable to expect the exhaustive audit of all node modules. That said, "major tools and things by international corporations" like Gatsby depend on the topic library [0]. https://www.npmjs.com/browse/depended/event-source-polyfill https://www.npmjs.com/browse/depended/event-source-polyfill
- 88913527 5y agoThought experiment: imagine you were in a country being shelled by foreigners; the thought process shaping your decision making might be different from someone sitting a safe country. Granted, it's possible these commits are from people outside Ukraine, in which case, I wouldn't give them a pass.
- deleted 5y ago[deleted]
- pmontra 5y agoI even agree with the message but we must keep this out of open source or we're going to lose all of it because nobody will be able to trust it and use of open source will immediately fail certifications. This is wells poisoning, all of them.
- 88913527 5y agoWhy should I trust open source today? Packages are routinely hacked, political message or not. I 100% agree this has no place in open source but (1) people subject to the effects of war aren't in most sound state of mind and (2) "npm install" is arbitrarily running pre- and post- hook commands that can do all sorts of fun things on your machine. This commit looks harmless in comparison to packages looking for wallets and AWS credentials. OSS is used not because it's safe or secure, but because the benefits outweigh the costs.
- hda2 5y ago> Why should I trust open source today? Packages are routinely hacked, political message or not. Correction: NPM packages are routinely hacked. I've been using linux packages for two decades, and not once have they been hacked (to my knowledge). I consider those packages to be infinity more secure than proprietary packages where I and others can't check what's running under the hood. OSS being safe and secure is one of the primary reasons why I prefer open source to closed source software.
- 5y ago
- bavell 5y agoAround line 1050. Triggers an alert and opens a new page.
- mediumdeviation 5y agoSpecifically 15 seconds after the code is loaded - since this is a polyfill this means immediately after the page loads - it checks if your browser is in one of Russia's timezones, and alerts the message if it is. It then tries to use window.open to open a change.org petition (user? I'm wary of checking the link), but because this call is triggered by a timer and not user interaction, most browser's popup blocker will block it by default.
- TobyTheDog123 5y agoChange.org is a legitimate site -> it's just a campaign to donate to Ukraine, still unacceptable to include as a forced-window-open
- qrush 5y agoRan this through Google Translate, omitting URLs: 24 February Russia attacked Ukraine The people of Ukraine are universally mobilized and ready to defend their country from enemy invasion 91% of Ukrainians fully support their President Volodymyr Zelensky and his response to the Russian attack. The whole world condemned the unjustified invasion and decided to impose unprecedented sanctions against Russia. With each new day, they will be felt more and more strongly among civilians. At the same time, the Russian government restricts citizens' access to external information, planting one-sided formulations and versions of what is happening. As a reliable source of information, download the secure Tor Browser: Stop this senseless war! Stop war criminal Putin!
- themanmaran 5y agoOn version 1.0.26. Committed 23 days ago as "update": https://github.com/Yaffle/EventSource/commit/de137927e13d8afac153d2485152ccec48948a7a https://github.com/Yaffle/EventSource/commit/de137927e13d8af... Also looking more at the update, I'm guessing it came from the repo owner (who is in Russia), not necessarily "political activists". Committed by a deleted "Viktor".
- amscanne 5y agoWhat do mean deleted? The commit author is “Viktor Mukhachev <vmukhachev@rocketsfotware.com>” but from a GitHub perspective it seems pushed directly to master. AFAIK GitHub links commits to usernames based on public emails associated with accounts, purely as a UI convenience.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- ramesh31 5y agoThis is in the latest published version 1.0.26 https://www.npmjs.com/package/event-source-polyfill https://www.npmjs.com/package/event-source-polyfill
- mediumdeviation 5y agoThe version was released 22 days ago. npm has a list of dependents https://www.npmjs.com/browse/depended/event-source-polyfill https://www.npmjs.com/browse/depended/event-source-polyfill. Gatsby is the big one, and it doesn't use a lockfile or pin the specific version so any new installation will receive the bad version, but this package is to only be used in development environment https://github.com/gatsbyjs/gatsby/blob/441a5af8e665256c7703854c5c8a4144c2e8e103/packages/gatsby/cache-dir/polyfill-entry.js#L4 https://github.com/gatsbyjs/gatsby/blob/441a5af8e665256c7703....
- sph 5y agoCommitted 23 days ago and no contributor or author has deigned to do anything about it. Says a lot about the health of this library. The "open source maintainers are not your bitch" argument is moot when one publishes a library on something like npm and then disappears when a security incident happens. I reckon publishing a library on a package manager should come with a promise of responsibility or at least communication.
- emteycz 5y agoI don't think that's reasonable. People use NPM for various purposes, and professional-grade software with guarantees is only one use of many. You need to vet your packages. Always, even if you paid for it. There are package managers that work with Github repos. Should this apply to every public Github repo too?
- sph 5y agoFine, then let's adopt a standard of announcing whether you're serious about your projects, and then other people know if they can rely on your library or not. Some kind of "verbal" promise of being proactive when catastrophe happens. That you'll personally won't bundle malware in your code, or your reputation will suffer. I mean it. The open source world, especially the JS ecosystem, desperately needs something like this. And a monetary incentive isn't enough, unless it's significant, but no one will pay $500 a month per JS library they depend on. A simple ".serious-project" committed to the project root would suffice.
- yellowapple 5y ago> And a monetary incentive isn't enough, unless it's significant, but no one will pay $500 a month per JS library they depend on. Maybe they should, and if they fail to do so, then maybe they have zero right to complain about it.
- sph 5y agoLet's see how many people will pay money for their `is-odd` dependency. Again, enforcing responsibility by paying is non viable and doesn't scale, especially in the JS world when you depend on 500 packages for a bare React project. Yet I as an open source developer I want to announce that my projects are actively maintained, i.e. I'm serious about them and I'll react in less than 23 days if someone adds malware to my code.
- jsguy 5y agoI know right, 2 spaces for indentation!!!
- oefrha 5y agoWe should probably start an open source sanction list of individuals who abuse trust to ship malware. The faker/colors guy, node-ipc guy, whoever's responsible for this, etc. Then npm audit or some other checker should crit if there's a package under their control in your supply chain. Well they can assume new identities, but at least we learn about clearly unsafe packages created before any identity change.
- TobyTheDog123 5y ago100% agree, perhaps instead of only tracking usernames it can also track external Github URLs (to portfolios, linkedin, twitter, and the like), email addresses, etc etc, just to make it a little harder to evade the sanction while also taking credit for their work off of Github.
- 0des 5y agoMaybe we could pin a symbol on their avatars, to make them easy to identify
- TobyTheDog123 5y ago
- idontknowifican 5y agoit’s always the people accusing folks of being nazis, but it turns out they’re the real nazi. pretty cool shit going on
- deleted 5y ago[deleted]
- rubyist5eva 5y agoOr a scarlet letter. https://en.wikipedia.org/wiki/The_Scarlet_Letter?msclkid=b47519cbb7a311eca375463a82e75c1c https://en.wikipedia.org/wiki/The_Scarlet_Letter?msclkid=b47...
- Aeolun 5y agoAt least this doesn’t delete your hard drive. Seems relatively benign.
- MBCook 5y agoIs that now the standard we hold people to in NPM world?
- SilasX 5y agoI assume it’s a reference to this incident, which didn’t quite destroy hard drives but got them into a pretty messed up and hard-to-fix state: https://news.ycombinator.com/item?id=16435305 https://news.ycombinator.com/item?id=16435305
- TobyTheDog123 5y agoThere should still be a zero-tolerance policy for hidden undisclosed functionality in open source repos
- memish 5y agoFurther, there should be zero-tolerance policy for injecting The Current Thing.
- TobyTheDog123 5y agoTo me it doesn't really matter what is injected, as long as it's undisclosed in places people would look (NPM/Readme/Docs/etc), it's unacceptable
- megous 5y agoIt's in the code. That's where people should look first and foremost in opensource dependencies. Otherwise how do you know you're not pulling in some horrible, bug ridden crap as a dependency? Most npm code has almost 0 documentation anyway.
- 0des 5y agoStdlib or die. You did this to yourself by trusting strangers for your laziness. "Its just a package for X" until its not.
- yibg 5y agoSo… no more open source?
- krasin 5y ago>So… no more open source? No more random-source. And no more "automatically pull from master, then build & deploy".
- djbusby 5y agoJust pipe curl to bash ;)
- tbrownaw 5y agoWell, maybe no more "pull someone else's master and build without scanning". Inside a walled garden / from specific people you trust should be fine. Some automated scanning could maybe be ok-ish at least sometimes.
- deleted 5y ago[deleted]
- CodeWriter23 5y agoThis is why I commit node_modules to my own repos.
- 0des 5y agoUnless you are reviewing the code in your assumedly large bundle of dependencies there, this is not a solution if you weren't posting this in jest
- Andoryuuta 5y agoWhat is it about nodejs/NPM in specific that leads to malicious changes being so noteworthy/significant? I barely never see anything about other package indexes (crates.io, PyPI, etc). Doesn't npm also use a lock file by default for packages?
- ElectricalUnion 5y agoNPM default "package-lock.json" lock files only prevent your immediate dependencies from changing. If a transitive dependency (the majority of them) have changed, you're out-of-luck.
- maxloh 5y agoIf I recall it right, `npm ci` installs the exact same version defined in package-lock.json, for all dependencies.
- rfoo 5y agonpm lock file is platform-dependent, so people are reluctant to check it in.
- johnny22 5y agoyou missed the package typo name hijacks on pypi that installed malware?
- feross 5y agoThere's a few reasons. First, the scale of the JavaScript ecosystem. JavaScript is so much larger than every other ecosystem, so even a very small probability event (somebody introducing malware into a package) can happen surprisingly often given the scale of the ecosystem. Supply chain attacks are a problem in all open source ecosystems – not just JS – but they are a bit rarer and don't effect as many people so fewer people take note. Second, npm was one of the first package managers to solve the classic "dependency hell" problem. In Python, if you have two dependencies, A and B, which both depend on different versions of C, say C@1.0.0 and C@2.0.0, respectively, then you're in trouble. You have an broken project. Python can only install one version of C. So now you're in dependency hell. Npm on the other hand just installs both versions of C and it gives A the version that it wants, C@1.0.0. And it gives B the version that it wants, C@2.0.0. Both packages are happy - problem solved. This caused Python maintainers to think twice before adding a new dependency lest they cause "dependency hell" for their users. Much better to just copy paste these 50 lines of code rather than adding a dependency. So there was an intrinsic sort of resistance – some pain is involved in adding new dependencies. Npm maintainers had no such constraints. In a way, npm’s better developer experience led to the whole module ecosystem scaling "too well". Disclosure: I started Socket (https://socket.dev https://socket.dev) to help solve open source supply chain security. To learn more, see: https://news.ycombinator.com/item?id=30521913 https://news.ycombinator.com/item?id=30521913
- adamscybot 5y agoThe web needs APIs that enables certain blocks of codes to run under specific permission constraints. Such constraints might include ability to read/write to DOM; window.alert; redirecting (well I guess CSP covers that one) etc. At least let us mitigate it.
- easrng 5y agoThis already exists: iframe sandboxes and content security policies. All we need now is a library that allows you to easily load, run, and interact with code in a sandboxed frame, using something like Comlink to make it feel as if it's all running in the same environment.
- adamscybot 5y agoI know about CSP and iFrames, but I think they aren't ergonomic enough to be used as mechanisms to restrict deps right? Iframes need a full web context whilst CSP cant target individual code blocks. For example, I might want my code to be able to do alerts, but I dont want dependency x to be able to. EDIT: Ah I think thats what you meant by your "code in a sandboxed iframe thing". Fair.
- sergiotapia 5y agoWhy does the JS ecosystem attract so many puddingheads like this with their emojis and their cotton-candy bullshit? No wonder it's a house of cards.
- adamscybot 5y agoTBH I think its not because JS somehow fundamentally attracts a different group of people, its probably more like: - It being web based means you can target this kind of software for maximum "impact" - NPM dep trees are massive and you generally have thousands of tiny libs. The chance of something like this happening and being noticed goes up therefore. - NPM ecosystem is a bit more wild west which again leads to increased chance of something like this being able to occur in the first place.
- ev1 5y agoOn the emoji side: JS devs are frequently fullstack/designers sometimes/on Macs, which make emoji very easy to use. So they end up using it. You rarely/ever see things like emoji commit messages in the other worlds (ex C#, Java, etc)
- ridaj 5y agoWell, open source volunteering is a form of anti-capitalistic political activism to begin with. This is just adding a geopolitical angle to it, but all FOSS is political already. When you depend on an open source project, you depend on the politics of that project as well.
- larsnystrom 5y ago
- runarberg 5y agoReading the source the compromise is on these lines in particular (https://github.com/Yaffle/EventSource/blob/de137927e13d8afac153d2485152ccec48948a7a/src/eventsource.js#L1032-L1090 https://github.com/Yaffle/EventSource/blob/de137927e13d8afac...). To experience the exploit set your computer timezone to any Russian timezone (e.g. asia/omsk) and paste the following data URL to your url bar: data:text/html;charset=utf-8,<!DOCTYPE html><title>EventSource</title><meta charset="utf-8"><script type="module">import "https://unpkg.com/event-source-polyfill@1.0.26"</script> In 15 seconds an alert window will open with a message which translates to: > On February 24, Russia attacked Ukraine. > The people of Ukraine are universally mobilized and ready to defend their country from enemy invasion. 91% of Ukrainians fully support their President Volodymyr Zelensky and his response to the Russian attack. > The whole world condemned the unjustified invasion and decided to impose unprecedented sanctions against Russia. With each new day, they will be felt more and more strongly among civilians. > At the same time, the Russian government restricts citizens' access to external information, planting one-sided formulations and versions of what is happening. > As a reliable source of information, download the secure Tor Browser: > https://www.torproject.org/ https://www.torproject.org/ > And visit: > https://www.bbcweb3hytmzhn5d532owbu6oqadra5z3ar726vq5kgwwn6aucdccrad.onion/russian https://www.bbcweb3hytmzhn5d532owbu6oqadra5z3ar726vq5kgwwn6a... > Stop this senseless war! Stop war criminal Putin! After you dismiss the alert window a new window will open with the page http://www.change.org/NetVoyne http://www.change.org/NetVoyne
- teabee89 5y agoI recommend reading "What NPM Should Do Today To Stop A New Colors Attack Tomorrow" by Russ Cox (Go's lead): https://research.swtch.com/npm-colors https://research.swtch.com/npm-colors
- feross 5y agoAlso see "What's Really Going On Inside Your node_modules Folder?" for examples of recent supply chain attacks and steps you can take to protect your team: https://socket.dev/blog/inside-node-modules https://socket.dev/blog/inside-node-modules
- sebmellen 5y agoWow, awesome to see what you're working on with Socket. I feel it's a much-needed tool. One question though: how do you think https://socket.dev https://socket.dev will compare to https://snyk.io/ https://snyk.io/ and other similar tools? How do you differentiate yourself from competition in the space? (I've been a big fan of yours since early WebTorrent days.)
- feross 5y agoSnyk doesn’t address supply chain attacks. Snyk and the entire security industry is obsessed with identifying known vulnerabilities. But they all miss the point. Looking for known vulnerabilities is reactive. Vulnerabilities take weeks or months to be discovered. A malicious dependency can be updated, merged, and running in production in days or even hours. We need to assume all open source may be malicious and try to proactively detect indicators of compromised packages. A better approach is to detect when dependency updates introduce new usage of risky APIs such as network, shell, filesystem, and more. And thanks for the WebTorrent love!
- sebmellen 5y agoGreat answer, thank you! I'm going to sign my company up for socket.dev.
- cosmiccatnap 5y agoThat's a funny way to say "leveraged by it's authors for their ends" Maybe something's are more important than a js package?
- sebmellen 5y agoI wonder if Yarn can do anything more to solve these problems from a CLI tool perspective. Stricter version locking? Better alerts for compromised dependencies?
- nathanaldensr 5y agoYarn and NPM are enablers of these issues, not solutions to them. The convenience they afford combined with the culture of the JavaScript package ecosystem needs to be entirely revisited. As it stands, we are all simply waiting for something widescale and truly serious to happen from one of these incidents. Then--and only then, it seems--will mature perspectives be called for.
- TobyTheDog123 5y agoSnyk is having a field day with new signups.
- feross 5y agoSnyk doesn’t address supply chain attacks. Snyk and the entire security industry is obsessed with identifying known vulnerabilities. But they all miss the point. Looking for known vulnerabilities is reactive. Vulnerabilities take weeks or months to be discovered. A malicious dependency can be updated, merged, and running in production in days or even hours. We need to assume all open source may be malicious and try to proactively detect indicators of compromised packages. A better approach is to detect when dependency updates introduce new usage of risky APIs such as network, shell, filesystem, and more. Disclosure: I started Socket (https://socket.dev https://socket.dev) to help solve open source supply chain security.
- pgcj_poster 5y agoPretty much every Western democracy is sanctioning Russia, causing severe shortages that are felt most by ordinary Russian people -- but it crosses the line when a Russian expatriate makes an anti-invasion message show up for Russian visitors to some websites that used his code, "provided 'as is', without warranty of any kind, including fitness for a particular purpose"?
- awb 5y agoWhy is "compromised by political activists" in the title? "political activists" is 1) plural (wasn't it only 1 committer?) and 2) an opinionated label for someone we don't know much about. Sure, the commit may be an act of political activism, but to label the individual based on this one action seems inappropriate. And "compromised" makes it sound like it's against the will of the maintainers. Do we know that? The commit was 23 days ago. There's an ongoing open discussion here where there are folks defending both sides: https://github.com/Yaffle/EventSource/issues/202 https://github.com/Yaffle/EventSource/issues/202 Anyway, a better title might be "event-source-polyfill displays popup about Ukraine in Russian timezones" or if its malware, then "event-source-polyfill affected by malware in Russian timezones"
- runarberg 5y agoI think the title can be shortened to NPM package event-source-polyfill sabotaged. Sabotage is a better word since it is not loaded politically. It does not infer a reason nor motive. Just that something happened which was deliberately done by someone.
- zackbloom 5y agoSabotage, to me, explicitly means that the act was committed with the intent of derailing the project’s original purpose. This act seems orthogonal to the original intent of the project, so it’s underhanded but it’s not really sabotage.
- runarberg 5y agoSabotage is quite a fascinating concept. IWW are big promoters of using sabotage as direct action. An industrial saboteur might have the goal of disrupting the supply chain causing damage to their boss’s profits, either as a revenge for poor labor condition, or as negotiating tactic during a strike. Here the saboteur is disrupting at the end of the supply chain when the product is consumed with the goal of delivering a political message. Like I said sabotage isn’t loaded and does not depend on the motive. Only that something was disrupted on purpose.
- 5y ago
- rektide 5y ago100% off topic but golly this "dont unleash zalgo" fear & it's propensity for spawning new sync+async concurrency systems. if a promjse weren't so vengefully async we could have just not written most of this code: this.abort = function () { if (this.signal._reader != null) { this.signal._reader.cancel(); } this.signal._aborted = true; };
- deleted 5y ago[deleted]
- andrew_ 5y agoAt the very least, this should have been a minor version bump, as it changes the output of the package and adds a new feature in the popup. The proper bump would have been a major version. But the author of the commit wasn't looking to be proper. They were looking to make a statement.
- metta2uall 5y agoLooks like a pretty reasonable & non-destructive message to reach Russians who are within the curtains of Kremlin propaganda.. Plus it'll teach some people about dependency management.
- evocatus 5y agoGood. If you open yourself up to this form of exploitation by increasing your attack surface proportional to the order of the insane dependency graph that is the NPM ecosystem... then prepare to be exploited.
- megous 5y agoSo my NIH "syndrome" is not so bad, after all. :D
- Shadonototra 5y agocompromised? it is his code, he can do what ever he wants to do he can put a ukranian flag on my terminal, just like he can put a russian flag on your terminal, it is the purpose of his library, it's not yours you decided to rely on this individual for free, without consulting, without asking yourself how updates are delivered and what he plan to do with his code you are the only one responsible of compromising your company by depending on such library NPM/Cargo driven development is bad for everyone if code on NPM/cargo can't be reviewed by moderators, then you can't complain if you don't review code from your dependencies, then you also have your part of responsibility