8 ms·
Social engineering campaign targeting tech employees spreads through NPM malware
- bobthepanda 3y ago…do people just accept invitations to clone repos on Whatsapp?
- tsak 3y agoIt's the least you can do for our North Korean comrades
- SketchySeaBeast 3y agoI can only assume it's the same people who are opening "ImportantDocument.doc.exe" in their email.
- ilc 3y agoNice ad.
- tsak 3y agoMy thoughts exactly. Every time something like this makes the frontpage, it's a thinly veiled ad for whomever the author works for. I really want to see those WhatsApp chats...
- TechBro8615 3y agoThe last few articles I've read about dependency chain attacks have been from socket.dev, and frankly, they've all been interesting and included important research. I don't mind content marketing when it's relevant and a description of important work. Would you rather nobody get paid to work on products targeting supply chain integrity? It's a real and important problem.
- elcerebro 3y agoI don’t think anyone has issues with pertinent content marketing that also provides something to the community. The argument can be made that the _important_ work was already done by GitHub and Phylum. This just appears to be a derivative work without any additional value add. That is, it functions mostly as an advertisement. Doesn’t help that they clearly don’t even have all the malware packages in their system from this campaign, three weeks after the attacks… https://socket.dev/search?e=&q=Btc-api-node https://socket.dev/search?e=&q=Btc-api-node
- ianpenney 3y agoIn his talk, Feross mentioned that it would cost approximately 1 billion dollars to scan the entire npm ecosystem. They do it on demand for their customers IIRC. Try signing up and running their scans on it.
- elcerebro 3y agoThere’s no way that’s true. Last I checked there were 16M packages in npm, not counting versions. If we bump that up to 20M and add a multiple of 30 to account for versions, we get 60M total tar.gz files we’d need to scan. At a total cost of $1B that would put scanning a single package at $16/package? Nonsense. Even at $1 in compute time on aws that feels outlandishly high… You can’t retroactively scan the package Socket missed. It was removed from npm. Scanning on demand means you’re going to miss critical relationships across threat groups, or across disparate but related packages.
- ianpenney 3y agoRetroactive scanning, you have a point. Integrating the scan into your CI/CD would catch it. As for the numbers: see 39 mins into https://youtu.be/jWujI7Hk8O4 https://youtu.be/jWujI7Hk8O4 I used to work at npm as the SRE manager right before the acquisition and the ballpark figures make sense to me.
- 3y ago
- ianpenney 3y agoBut they’ve got a point. And they’re one of the first to market. Yeah I’d get it if their solution was only tangentially applicable (it’s directly applicable). I certainly don’t want YC:HN to turn into GPT generated ad-city either. If you met Feross, you’d agree he and his team are deserving of the credit for finding a timely and constructive solution to supply chain problems without filling OpenAI with your IP. He lives the kind of values we respect on YC:HN. I had the pleasure at Refactor Conf in Toronto a couple of weeks ago. You can watch his talk here: https://youtu.be/jWujI7Hk8O4 https://youtu.be/jWujI7Hk8O4 (I have no pecuniary interest in Refactor conf. I just think it was an awesome time.)
- hn_throwaway_99 3y agoBoth of these things can be true at the same time: 1. An article is posted with informative, useful, original content. 2. An important motivation of the article author is marketing to get people to use or become aware of their product. I see no problem with this. I think it's always important to keep the motivation of the author in mind, regardless of whether it's an ad for a product or just the author themself.
- louislang 3y agoI'm co-founder of Phylum (https://phylum.io https://phylum.io), the group that originally identified/reported this campaign back in June [1] and that Github references [2] in their security alert. Happy to answer any questions about this campaign and any other supply chain attacks. 1. https://blog.phylum.io/sophisticated-ongoing-attack-discovered-on-npm/ https://blog.phylum.io/sophisticated-ongoing-attack-discover... 2. https://github.blog/2023-07-18-security-alert-social-engineering-campaign-targets-technology-industry-employees/ https://github.blog/2023-07-18-security-alert-social-enginee...
- Uptrenda 3y agoGood work on finding this. This is a scary attack.
- louislang 3y agoThanks, we report _many_ of these every day to all the ecosystems. It's wild how many malware packages get released. Doing our best to help clean up these ecosystems for everyone!
- yjftsjthsd-h 3y agoI guess a couple questions, if you don't mind: 1. Can you say how you find things like this? Just bulk scanning packages doing pattern matching heuristics? 2. I know it gets talked about every time, but I'd be interested in your perspective on how we (as an industry) could stop this kind of thing from happening. Is it as easy as blocking hooks from executing, or is there a better way forward? EDIT: Oh, just now seeing https://news.ycombinator.com/item?id=36869587 https://news.ycombinator.com/item?id=36869587 - so I'm assuming your answer is better sandboxing:)
- padjo 3y agoI’ll be the first to say it: it looks like breaking everything down into a dependency graph of a million tiny packages that nobody understands and letting anyone publish anything they like might have been a bad idea.
- dcsommer 3y agoAt least npm has namespaces (scopes) to group packages by trustable entity. I wish cargo had namespaces. It's a big miss for an otherwise security conscientious project imo.
- koolba 3y agoMore important than the namespace is who published the package. I'm more inclined to trust an individual I know who takes security than a namespace that may change hands. NPM exposes that info in the _npmUser field: https://github.com/npm/registry/blob/master/docs/REGISTRY-API.md#getpackageversion https://github.com/npm/registry/blob/master/docs/REGISTRY-AP.... That gives "name" (NPM username) and email. While there are thousands of packages, I bet there's a much smaller number of publishers to worry about. Like this guy pretty much has a separate NPM package for every single function that he writes: https://www.npmjs.com/~sindresorhus https://www.npmjs.com/~sindresorhus (1162 packages under his name alone, maybe even more in other namespaces).
- skydhash 3y agoWow. There is even one package to not use a JavaScript object: https://www.npmjs.com/package/conf https://www.npmjs.com/package/conf
- lelanthran 3y ago> More important than the namespace is who published the package. I'm more inclined to trust an individual I know who takes security than a namespace that may change hands. Doesn't matter if you trust them; can you trust the 100+ dependencies they pull in? If it's a large package, you can be certain that they aren't verifying their deps.
- pcthrowaway 3y agoJS Party episode on Socket, if anyone is interested: https://changelog.com/jsparty/272 https://changelog.com/jsparty/272
- OJFord 3y agoWe really need better (easier to use) sandboxing for apps, or in this case a project (create directory, few allowed apps, no access to rest of fs or a dummy fs, whitelisted urls/IPs only, etc.). Sure you can use a VM, a container, firejail (for an app), etc. but it all has quite a high barrier to entry & burden to bother with, so the vast majority don't, and the majority of the rest only do occasionally for something they already trust less.
- louislang 3y agoWe (https://phylum.io https://phylum.io) actually open sourced our sandbox for this exact purpose. https://github.com/phylum-dev/birdcage https://github.com/phylum-dev/birdcage It's baked into our CLI and supports limiting access to network, disk, etc. during package installation. For example, running something like phylum npm install react Will perform the installation in a way that disallows access to disk and network that aren't explicitly approved. This prevents malicious packages from grabbing and exfiltrating things like developer SSH keys during package install.
- OJFord 3y agoHa, well now I look like a shill installed in the audience. Nice though, I'll give that a go, thanks. It's probably manageable through direnv & some shell magic, but it'd be nice to have a built-in way of saying 'everything in this directory gets run through phylum [with these defaults] and has access to only this directory [by default]'.
- louislang 3y agoIt's basically managed by a TOML file, so should be able to specify something like that. If that's not to your liking, you can extend the CLI using Typescript and make it do whatever you want. If you have any questions/issues, feel free to shoot me a message. My email should be in my profile!
- fsflover 3y agoTry Qubes OS. It runs everything in VMs, but the UI is amazingly usable. The VMs look like ordinary windows with different border colors. Inter-VM copy-paste works with ctrl+shift+c/v.
- Joel_Mckay 3y agonpm and pip is a dumpster fire for IT production environment security. The out-of-band ecosystems evolved to sidestep bureaucratic processes in favor of rapid release versioning. Anyone who understands the auditing role and provable chain of accountability FOSS OS packagers volunteer for... knows why it was necessary. Malware will always show up, but it is arguably more important to be able to hold sources accountable. =)
- zupa-hu 3y agoThe title is incorrect, npm malware spreads through social engineering, not social engineering through npm malware. I expected npm packages to somehow carry the social engineering, like carry a message somehow, but that’s not the case.
- namaria 3y ago"It's called fullstack webdev jobs" /s