4 ms·
From this article, Denis Pushkarev seems to be a remarkably principled developer in a horrible situation, and I admire his commitment to this project. Setting t
by btown 4y ago
From this article, Denis Pushkarev seems to be a remarkably principled developer in a horrible situation, and I admire his commitment to this project. Setting that aside, though, is anyone else alarmed that such a widely used project has exactly one maintainer who is able to push arbitrary changes without review? Especially one already in legal trouble and significant debt, unable to travel, for a project embedded in Fortune 500 e-commerce and (likely) intranet/administrative sites, with an extremely large surface area of used APIs where malicious minified code might easily go unnoticed and is highly difficult to audit?
I absolutely feel for his situation. Right now, the degree to which he could be threatened into allowing a malicious group to push changes in his name should not be taken lightly. Hopefully this article reaches the attention of some of the CISOs at companies who rely on the project, and a path towards a situation where multiple parties have visibility into release management can be explored. And honestly, such a solution might be the best thing to make Denis and his family less of a target.
(In the meantime, pin your core-js dependency, and track https://security.snyk.io/vuln/npm?search=core-js https://security.snyk.io/vuln/npm?search=core-js as well as npm audit. Arguably there should be an advisory category for known vulnerable maintenance situation - I'm not sure if such a registry exists. One might say that every open source project is vulnerable in some way, but there's nuance and splash radius to consider here, and core-js does not have much defense-in-depth at the moment.)
- johnywalks 4y agoIsn't that the issue though? Nobody cares until it's too late.
- cyral 4y agoYour first paragraph reminded me of this article: https://david-gilbertson.medium.com/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5 https://david-gilbertson.medium.com/im-harvesting-credit-car... Imagine this scenario taking place with this package if someone got ahold of his NPM account.
- ufmace 4y agoOooh thanks, I had been looking to find that article again for a while and couldn't track it down for anything. In a completely unrelated matter, Google search results quality has really declined in the last few years...
- modestmc 4y agoI know far too well how you feel, happy you found what you’ve been missing. Out of curiosity, what did you remember about the link that you tried searching for? Do you remember when you last saw it? [insert semicoherent hopium about ChatGPT as a magical panacea here]
- ufmace 4y agoI remembered it as an article where a guy semi-jokingly claimed to have hacked most of the web through a supply-chain exploit and listed off a ton of clever things he did to evade all of the immediately obvious ways to notice that such a thing was happening. Pretty sure I saw it here on HN originally, but I couldn't come up with any search terms to find it in Google, Bing, DDG, HN Angolia search, etc.
- modestmc 4y agoThe author said he updated the article, so if the link changed then maybe; however, I can tell you somebody definitely reposted it last night and it got almost 100 points. Too funny. I assume you tried punching in keywords like “fake NPM package hack” or something like that?
- ufmace 4y agoPretty much yeah, and no combination I could come up with brought up the article on the first few pages, mostly just infosec blogspam. Of course it might actually show up in searches now, since it's been on the HN front page in the last 24 hours.
- deleted 4y ago
- sally_glance 4y agoWell. There is little doubt that he would be a good fit for at least a normal Engineer position in any of these companies. If they didn't hire him yet your guess as of why is as good as mine. Edit: This was not meant to be read in a negative kind of way. I'd try to hire him if I had an open position to fit.
- throwaway290 4y agoEdited my comment since I saw this: > Now I cannot leave Russia, because after the accident I have outstanding lawsuits in the amount of tens of thousands of dollars and I am forbidden to leave the country until they are paid off. Interesting. I know a person who somehow emigrated from Russia last year with some debt and is paying it off. But perhaps there is some other condition I don't know about. But anyway it would be more difficult to emigrate to another country long term with a criminal record, they always ask about it on visa applications. If I was more cynical I would think an evil government could use the carrot of forgiving his lawsuits in exchange for pushing some backdoors but I don't think this would go unnoticed Very unfortunate situation to be in, though my sincere hate for reckless russian drivers I have seen a lot in my life makes it a bit difficult to sympathize.
- deleted 4y ago[deleted]
- toyg 4y ago> Especially one already in legal trouble and significant debt, unable to travel ... and living in a country involved in war, run by a regime for which respect for the rule of law is a "nice to have". If I were in FSB, I'd be banging at this guy's door right now, and making his life as comfortable as I can. Imagine dropping an obfuscated killswitch on half the global web, that is Real Power right there; or silently siphoning out credentials from FAANG-level companies; or or or... We are incredibly lucky that Herr Putin's henchmen are actually not very good.
- shmolf 4y agoThat snyk.io search also uses core-js. window['__core-js_shared__'].versions Just more evidence of how prevalent and important that library is.