5 ms·
We also caught this right away at Socket, https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack https://socket.dev/blog/npm-author-qi
by 33a 1y ago
We also caught this right away at Socket,
https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack https://socket.dev/blog/npm-author-qix-compromised-in-major-...
While it sucks that this happened, the good thing is that the ecosystem mobilized quickly. I think these sorts of incidents really show why package scanning is essential for securing open source package repositories.
- hsbauauvhabzb 1y ago[flagged]
- hsbauauvhabzb 1y agoFor those interested, points associated with this post spiked to at least 4 then dropped back to one. Take of that what you will.
- fn-mote 1y agoYou could at least offer some kind of substantive criticism of the tool (“socket”).
- hsbauauvhabzb 1y agoDo I need any? Automated tools cannot prevent malicious code being injected. While they can make attempts to evaluate common heuristics and will catch low hanging malware, they are not fool proof against highly targeted attacks. Either way, the parent post is clearly ambulance chasing rather than having a productive conversation, which should really be about whether or not automatically downloading and executing huge hierarchal trees of code is absolutely fucking crazy, rather than a blatant attempt to make money off an ongoing problem without actually solving anything.
- 33a 1y agoWhen we find malware on any registry (npm, rubygems, pypi or otherwise), we immediately report it to the upstream registry and try to get it taken down. This helps reduce the blast radius from incidents like this and mitigates the damage done to the entire ecosystem. You can call it ambulance chasing, but I think this is a good thing for the whole software ecosystem if people aren't accidentally bundling cryptostealers in their web apps. And regarding not copying massive trees of untrusted dependencies: I am actually all for this! It's better to have fewer dependencies, but this is also not how software works today. Given the imperfect world we have, I think it's better to at least try to do something to detect and block malware than just complain about npm.
- hsbauauvhabzb 1y agoSo instead you prolong the problem while making money? Nice!
- jondwillis 1y agoI’m all for thinking about second, or third, or fourth order effects of behavior, but unless you have proof that Socket is doing something like lobbying that developers keep using NPM against their own best interests, frankly, I don’t know what your point here is.
- josephg 1y ago> Do I need any? Automated tools cannot prevent malicious code being injected. While they can make attempts to evaluate common heuristics and will catch low hanging malware, they are not fool proof against highly targeted attacks. So just because a lock isn't 100% effective at keeping out criminals we shouldn't lock our doors?
- hsbauauvhabzb 1y agoIm not sure how that relates to the company ambulance chasing on what should be a public service announcement without a shade of advertising. That’s like lock companies parading around when their neighbour is murdered during a burglary but they weren’t because they bought a Foobar(tm) lock.
- LocalH 1y agoThe more tools that exist to help find vulnerabilities, the better, as long as they're not used in a fully automated fashion. Human vetting is vital, but using tools to alert humans to such issues is a boon.
- josephg 1y agoApparently it found this attack more or less immediately. It seems strange to attack a service like this right after it actively helped keep people safe from malware. I'm sure its not perfect, but it sounds like they deserve to take a victory lap.
- hsbauauvhabzb 1y agoI don’t think celebrating a company who has a distinct interest in prolonging a problem while they profit off it is a good thing, no.
- josephg 1y agoThey're profiting off helping to solve the problem through early warning and detection. And by keeping their customers safe from stuff like this. Seems good to me. I want more attention and more tooling around this problem. You seem mad at them for helping solve a real problem?
- deleted 1y ago[deleted]
- Yoric 1y agoSo how do you detect these attacks?
- veber-alex 1y agoAI based code review with escalation to a human
- Yoric 1y agoI'm curious :) Does the AI detect the obfuscation?
- justusthane 1y agoProbably. It’s trivial to plug some obfuscated code into an LLM and ask it what it does.
- spartanatreyu 1y agoYeah, but just imagine how many false positives and false negatives there would be...
- 33a 1y agoIt's actually pretty easy to detect that something is obfuscated, but it's harder to prove that the obfuscated code is actually harmful. This is why we still have a team of humans review flagged packages before we try to get them taken down, otherwise you would end up with way too many false positives.
- Yoric 1y agoYeah, what I meant is that obfuscation is a strong sign that something needs to be flagged for review. Sadly, there's only a thin line between obfuscation and minification, so I was wondering how many false positives you get. Thanks for the links in your other comment, I'll take a look!
- 1y ago