8 ms·

AFAICT, the only thing this attack relies on, is the lack of scrutiny by developers when adding new dependencies. Unless this lack of scrutiny is exclusive to

AFAICT, the only thing this attack relies on, is the lack of scrutiny by developers when adding new dependencies. Unless this lack of scrutiny is exclusive to JavaScript ecosystem, then this attack could just as well have happened in Rust or Golang.

hsbauauvhabzb 1y ago
JavaScript does have some pretty insane dependency trees. Most other languages don’t have anywhere near that level of nestedness.
- staminade 1y ago
  Don't they? I just went to crates.io and picked a random newly updated crate, which happened to be pixelfix, which fixes transparent pixels in pngs. It has six dependencies and hundreds of transient dependencies, may of which appear to be small and highly specific a la left-pad. https://crates.io/crates/pixelfix/0.1.1/dependencies https://crates.io/crates/pixelfix/0.1.1/dependencies Maybe this package isn't representative, but it feels pretty identical to the JS ecosystem.
  - koakuma-chan 1y ago
    It depends on `image` which in turn depends on a number of crates to handle different file types. If you disable all `image` features, it only has like 5 dependencies left.
    - staminade 1y ago
      And all those 5 remaining dependencies have lots of dependencies of their own. What's your point?
      - koakuma-chan 1y ago
        > What's your point? Just defending Rust. > 5 remaining dependencies have lots of dependencies of their own. Mostly well-known crates like rayon, crossbeam, tracing, etc.
        johnisgood 1y ago
        You cannot defend Rust if this is reality. Any Rust project I have ever compiled pulled in over 1000 dependencies. Recently it was Zed with its >2000 dependencies.
        koakuma-chan 1y ago
        I think it's justified for Zed. It does a lot of things.
        rudedogg 1y ago
        Zed isn’t special, I doubt Sublime Text has thousands of dependencies. It’s a language/culture problem. Edit: Ghostty is a good counter-example that is open source. https://github.com/ghostty-org/ghostty/tree/main/pkg https://github.com/ghostty-org/ghostty/tree/main/pkg
        koakuma-chan 1y ago
        Zed is closer to IntelliJ or VSCode than to Sublime Text.
        biggusdickus69 1y ago
        In the amount of bloat, yes.
        johnisgood 1y ago
        It is also important to note that this is not specific to Zed. As someone else have mentioned, it is a cultural problem. I picked Zed as an example because that is what I compiled the last time, but it is definitely not limited to Zed. There are many Rust projects that pull in over 1000 dependencies and they do much less than Zed.
- cxr 1y ago
  It's not possible for a language to have an insane dependency tree. That's an attribute of a codebase.
  - WD-42 1y ago
    Maybe the language should have a standard library then.
    - skydhash 1y ago
      C library is smaller than Node.js (you won’t have HTTP). What C have is much more respectable libraries. If you add libcurl or freetype to your project, it won’t pull the whole jungle with them.
      - int_19h 1y ago
        What C doesn't have is an agreed-upon standard package manager. Which means that any dependency - including transitive ones! - requires some effort on behalf of the developer to add to the build. And that, in turn, puts pressure on library authors to avoid dependencies other than a few well-established libraries (like libpng or GLib),
      - koakuma-chan 1y ago
        You can add curl to a Rust project too.
        aakkaakk 1y ago
        But why, when reqwest is enough for 99% of cases.
        koakuma-chan 1y ago
        It's bloated.
        WD-42 1y ago
- rixed 1y ago
  This makes little sense. Any popular language with a lax package management culture will have the exact same issue, this has nothing to do with JS itself. I'm actually doing JS quasi exclusively these days, but with a completely different tool chain, and feel totally unconcerned by any of these bi-weekly NPM scandals.
- BrouteMinou 1y ago
  Rust is working on that. It's not far behind right now, leave it a couple of years.
deleted 1y ago
[deleted]
coldpie 1y ago
I don't know Go, but Rust absolutely has the same problem, yes. So does Python. NPM is being discussed here, because it is the topic of the article, but the issue is the ease with which you can pull in unvetted dependencies. Languages without package managers have a lot more friction to pull in dependencies. You usually rely on the operating system and its package-manager-humans to provide your dependencies; or on primitive OSes like Windows or macOS, you package the dependencies with your application, which involves integrating them into your build and distribution systems. Both of those involve a lot of manual, human effort, which reduces the total number of dependencies (attack points), and makes supply-chain issues like this more likely to be noticed. The language package managers make it trivial to pull in dozens or hundreds of dependencies, straight from some random source code repository. Your dependencies can add their own dependencies, without you ever knowing. When you have dozens or hundreds of unvetted dependencies, it becomes trivial for an attacker to inject code they control into just one of those dependencies, and then it's game over for every project that includes that one dependency anywhere in their chain. It's not impossible to do that in the OS-provided or self-managed dependency scenario, but it's much more difficult and will have a much narrower impact.
- skydhash 1y ago
  If you try installing npm itself on debian, you would think you are downloading some desktop environment. So many little packages.
tomjen3 1y ago
That, and the ability to push an update without human interaction.
zelphirkalt 1y ago
At least in the JS world there are more people (often also more inexperienced people) who will add a dependency willy-nilly. This is due to many people starting out with JS these days.
user34283 1y ago
There is little point in you scrutinizing new dependencies. Many who claim to fully analyze all dependencies are probably lying. I did not see anyone in the comments sharing their actual dependency count. Even if you depend only on Jest - Meta's popular test runner - you add 300 packages. Unless your setup is truly minimalistic, you probably have hundreds of dependencies already, which makes obsessing over some more rather pointless.

hsbauauvhabzb 1y ago

JavaScript does have some pretty insane dependency trees. Most other languages don’t have anywhere near that level of nestedness.

staminade 1y ago
Don't they? I just went to crates.io and picked a random newly updated crate, which happened to be pixelfix, which fixes transparent pixels in pngs. It has six dependencies and hundreds of transient dependencies, may of which appear to be small and highly specific a la left-pad. https://crates.io/crates/pixelfix/0.1.1/dependencies https://crates.io/crates/pixelfix/0.1.1/dependencies Maybe this package isn't representative, but it feels pretty identical to the JS ecosystem.
- koakuma-chan 1y ago
  It depends on `image` which in turn depends on a number of crates to handle different file types. If you disable all `image` features, it only has like 5 dependencies left.
  - staminade 1y ago
    And all those 5 remaining dependencies have lots of dependencies of their own. What's your point?
    - koakuma-chan 1y ago
      > What's your point? Just defending Rust. > 5 remaining dependencies have lots of dependencies of their own. Mostly well-known crates like rayon, crossbeam, tracing, etc.
      - johnisgood 1y ago
        You cannot defend Rust if this is reality. Any Rust project I have ever compiled pulled in over 1000 dependencies. Recently it was Zed with its >2000 dependencies.
        koakuma-chan 1y ago
        I think it's justified for Zed. It does a lot of things.
        rudedogg 1y ago
        Zed isn’t special, I doubt Sublime Text has thousands of dependencies. It’s a language/culture problem. Edit: Ghostty is a good counter-example that is open source. https://github.com/ghostty-org/ghostty/tree/main/pkg https://github.com/ghostty-org/ghostty/tree/main/pkg
        koakuma-chan 1y ago
        Zed is closer to IntelliJ or VSCode than to Sublime Text.
        biggusdickus69 1y ago
        In the amount of bloat, yes.
        johnisgood 1y ago
        It is also important to note that this is not specific to Zed. As someone else have mentioned, it is a cultural problem. I picked Zed as an example because that is what I compiled the last time, but it is definitely not limited to Zed. There are many Rust projects that pull in over 1000 dependencies and they do much less than Zed.
cxr 1y ago
It's not possible for a language to have an insane dependency tree. That's an attribute of a codebase.
- WD-42 1y ago
  Maybe the language should have a standard library then.
  - skydhash 1y ago
    C library is smaller than Node.js (you won’t have HTTP). What C have is much more respectable libraries. If you add libcurl or freetype to your project, it won’t pull the whole jungle with them.
    - int_19h 1y ago
      What C doesn't have is an agreed-upon standard package manager. Which means that any dependency - including transitive ones! - requires some effort on behalf of the developer to add to the build. And that, in turn, puts pressure on library authors to avoid dependencies other than a few well-established libraries (like libpng or GLib),
    - koakuma-chan 1y ago
      You can add curl to a Rust project too.
      - aakkaakk 1y ago
        But why, when reqwest is enough for 99% of cases.
        koakuma-chan 1y ago
        It's bloated.
        WD-42 1y ago
rixed 1y ago
This makes little sense. Any popular language with a lax package management culture will have the exact same issue, this has nothing to do with JS itself. I'm actually doing JS quasi exclusively these days, but with a completely different tool chain, and feel totally unconcerned by any of these bi-weekly NPM scandals.
BrouteMinou 1y ago
Rust is working on that. It's not far behind right now, leave it a couple of years.

deleted 1y ago

[deleted]

coldpie 1y ago

I don't know Go, but Rust absolutely has the same problem, yes. So does Python. NPM is being discussed here, because it is the topic of the article, but the issue is the ease with which you can pull in unvetted dependencies. Languages without package managers have a lot more friction to pull in dependencies. You usually rely on the operating system and its package-manager-humans to provide your dependencies; or on primitive OSes like Windows or macOS, you package the dependencies with your application, which involves integrating them into your build and distribution systems. Both of those involve a lot of manual, human effort, which reduces the total number of dependencies (attack points), and makes supply-chain issues like this more likely to be noticed. The language package managers make it trivial to pull in dozens or hundreds of dependencies, straight from some random source code repository. Your dependencies can add their own dependencies, without you ever knowing. When you have dozens or hundreds of unvetted dependencies, it becomes trivial for an attacker to inject code they control into just one of those dependencies, and then it's game over for every project that includes that one dependency anywhere in their chain. It's not impossible to do that in the OS-provided or self-managed dependency scenario, but it's much more difficult and will have a much narrower impact.

skydhash 1y ago
If you try installing npm itself on debian, you would think you are downloading some desktop environment. So many little packages.

tomjen3 1y ago

That, and the ability to push an update without human interaction.

zelphirkalt 1y ago

At least in the JS world there are more people (often also more inexperienced people) who will add a dependency willy-nilly. This is due to many people starting out with JS these days.

user34283 1y ago

There is little point in you scrutinizing new dependencies. Many who claim to fully analyze all dependencies are probably lying. I did not see anyone in the comments sharing their actual dependency count. Even if you depend only on Jest - Meta's popular test runner - you add 300 packages. Unless your setup is truly minimalistic, you probably have hundreds of dependencies already, which makes obsessing over some more rather pointless.