3 ms·
How will multi-factor-authentication prevent such a supply chain issue? That is, if some attacker create some dummy trivial but convenient package and 2 years
by psychoslave 1y ago
How will multi-factor-authentication prevent such a supply chain issue?
That is, if some attacker create some dummy trivial but convenient package and 2 years latter half the package hub depends on it somehow, the attacker will just use its legit credential to pown everyone and its dog. This is not even about stilling credentials. It’s a cultural issue with bare blind trust to use blank check without even any expiry date.
https://en.wikipedia.org/wiki/Trust,_but_verify https://en.wikipedia.org/wiki/Trust,_but_verify
- deanc 1y agoThat's an entirely different issue compared to what we're seeing here. If an attacker rug-pulls of course there is nothing that can be done about that other than security scanning. Arguably some kind of package security scanning is a core-service that a lot of organisations would not think twice about paying npm for.
- cesarb 1y ago> If an attacker rug-pulls of course there is nothing that can be done about that other than security scanning. As another subthread mentioned (https://news.ycombinator.com/item?id=45261303 https://news.ycombinator.com/item?id=45261303), there is something which can be done: auditing of new packages or versions, by a third party, before they're used. Even doing a simple diff between the previous version and the current version before running anything within the package would already help.