8 ms·

The nx supply chain attack via npm was the bullet many companies did not doge. I mean, all you needed was to have the VS Code nx plugin installed — which always

The nx supply chain attack via npm was the bullet many companies did not doge. I mean, all you needed was to have the VS Code nx plugin installed — which always checked for the latest published nx version on npm. And if you had a local session with GitHub (eg logged into your company’s account via the GH CLI), or some important creds in a .env file… that was exfiltrated. This happened even if you had pinned dependencies and were on top of security updates. We need some deeper changes in the ecosystem. https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7...

captn3m0 1y ago
Yeah, Editor extensions are both auto-updated and installed in high risk dev environments. Quite a juicy target and I am surprised we haven’t seen large scale purchases by bad actors similar to browser extensions yet. However, I remember reading that the VsCode team puts a lot of effort in catching malware. But do all editors (with auto-updates) such as Sublime have such checks?
zenmac 1y ago
I usually make sure all the packages and db are local, so my dev machine can run in Airplane mode. And only turn on internet when use git push
- pmontra 1y ago
  All docs are local too, like we used to do with man pages and paper reference books or do you use another system for them? A second computer, a tablet, a phone?
deleted 1y ago
[deleted]
kardianos 1y ago
> We need some deeper changes in the ecosystem. I avoid anything to do with NPM, except for the typescript compiler, and I'm looking forward to the rewrite in Go where I can remove even that. For this reason. As a comparison, in Go, you have minimum version spec, and it takes great pains to never execute anything you download, even during compilation stage. NPM will often have different source then the github repo source. How does anyone even trust the system?
- RVuRnvbM2e 1y ago
  Fucking this. I have seen so many takes lamenting how this kind of supply chain attack is such a difficult problem to fix. No it really isn't. It's an ecosystem and cultural problem that npm encourages huge dependency trees that make it impractical to review dependency updates so developers just don't.
  - alehlopeh 1y ago
    “It’s not difficult to fix, just change the entire culture” The difficulty comes in trying to change the entire culture.
    - aspenmayer 1y ago
      “Doctor, it hurts when I do this!” “Stop doing that!” “But I wanna!”
      - Jensson 1y ago
        That is valid though, if someone says "It hurts when I walk" its not reasonable to tell them to not walk, you try to figure out why it hurts and if it can be fixed. Other languages has similar package managers as npm, but with much less issues, so it can be fixed without changing the package manager completely.
        aspenmayer 1y ago
        Wanna is distinct from gotta, after all.
  - zer00eyz 1y ago
    > It's an ecosystem and cultural problem that npm encourages huge dependency trees It is an ecosystem and culture that learned nothing from the debacle of left pad. And it is an affliction that many organizations face and it is only going to get worse with the advent of AI assisted coding (and it does not have to be). There simply arent enough adults in the room with the ability to tell the children (or VC's and business people) NO. And getting an "AI" to say no is next to impossible unless you're probing it on a "social issue".
oezi 1y ago
The key thing needed is a standard library which includes 100000 of these tiny one function libraries (has-ansi, color-name).
- lynnharry 1y ago
  I checked has-ansi. What's the reason that this library would exist and be popular? Most of the work is done by the library it imports, ansi-regex and then it just return ansi-regex.test(string), yet it has 5% of the weekly downloads of ansi-regex. ansi-regex also has fewer than 10 lines of code. I don't know anything about the npm ecosystem, what's the benefit of importing these libraries compared to including these code in the project?
  - herewulf 1y ago
    The benefit is getting your secrets stolen and pointing the blame at someone else? Yeah...
mark_l_watson 1y ago
The VS Code ecosystem has too much complexity for my tastes. I do keep a copy around with a few code formatting plugins installed but I feel more comfortable with Emacs (or Vim for my friends who are on that side of the fence). I am a consumer of apps using npm, not a developer, and I simply don’t like the auto updates and seeing a zillion things updated. I use uv and Python a lot, and I get a similar uneasy feeling there also, but (perhaps incorrectly) I feel more in control.
edem 1y ago
wow. i uninstalled the nx plugin a few weeks ago after completing the migration to pnpm.

captn3m0 1y ago

Yeah, Editor extensions are both auto-updated and installed in high risk dev environments. Quite a juicy target and I am surprised we haven’t seen large scale purchases by bad actors similar to browser extensions yet. However, I remember reading that the VsCode team puts a lot of effort in catching malware. But do all editors (with auto-updates) such as Sublime have such checks?

zenmac 1y ago

I usually make sure all the packages and db are local, so my dev machine can run in Airplane mode. And only turn on internet when use git push

pmontra 1y ago
All docs are local too, like we used to do with man pages and paper reference books or do you use another system for them? A second computer, a tablet, a phone?

deleted 1y ago

[deleted]

kardianos 1y ago

> We need some deeper changes in the ecosystem. I avoid anything to do with NPM, except for the typescript compiler, and I'm looking forward to the rewrite in Go where I can remove even that. For this reason. As a comparison, in Go, you have minimum version spec, and it takes great pains to never execute anything you download, even during compilation stage. NPM will often have different source then the github repo source. How does anyone even trust the system?

RVuRnvbM2e 1y ago
Fucking this. I have seen so many takes lamenting how this kind of supply chain attack is such a difficult problem to fix. No it really isn't. It's an ecosystem and cultural problem that npm encourages huge dependency trees that make it impractical to review dependency updates so developers just don't.
- alehlopeh 1y ago
  “It’s not difficult to fix, just change the entire culture” The difficulty comes in trying to change the entire culture.
  - aspenmayer 1y ago
    “Doctor, it hurts when I do this!” “Stop doing that!” “But I wanna!”
    - Jensson 1y ago
      That is valid though, if someone says "It hurts when I walk" its not reasonable to tell them to not walk, you try to figure out why it hurts and if it can be fixed. Other languages has similar package managers as npm, but with much less issues, so it can be fixed without changing the package manager completely.
      - aspenmayer 1y ago
        Wanna is distinct from gotta, after all.
- zer00eyz 1y ago
  > It's an ecosystem and cultural problem that npm encourages huge dependency trees It is an ecosystem and culture that learned nothing from the debacle of left pad. And it is an affliction that many organizations face and it is only going to get worse with the advent of AI assisted coding (and it does not have to be). There simply arent enough adults in the room with the ability to tell the children (or VC's and business people) NO. And getting an "AI" to say no is next to impossible unless you're probing it on a "social issue".

oezi 1y ago

The key thing needed is a standard library which includes 100000 of these tiny one function libraries (has-ansi, color-name).

lynnharry 1y ago
I checked has-ansi. What's the reason that this library would exist and be popular? Most of the work is done by the library it imports, ansi-regex and then it just return ansi-regex.test(string), yet it has 5% of the weekly downloads of ansi-regex. ansi-regex also has fewer than 10 lines of code. I don't know anything about the npm ecosystem, what's the benefit of importing these libraries compared to including these code in the project?
- herewulf 1y ago
  The benefit is getting your secrets stolen and pointing the blame at someone else? Yeah...

mark_l_watson 1y ago

The VS Code ecosystem has too much complexity for my tastes. I do keep a copy around with a few code formatting plugins installed but I feel more comfortable with Emacs (or Vim for my friends who are on that side of the fence). I am a consumer of apps using npm, not a developer, and I simply don’t like the auto updates and seeing a zillion things updated. I use uv and Python a lot, and I get a similar uneasy feeling there also, but (perhaps incorrectly) I feel more in control.

edem 1y ago

wow. i uninstalled the nx plugin a few weeks ago after completing the migration to pnpm.