3 ms·

The problem isn't specific to node. NPM is just the most popular repo so the most value for attacks. The same thing could happen on RubyGems, Cargo, or any of t

The problem isn't specific to node. NPM is just the most popular repo so the most value for attacks. The same thing could happen on RubyGems, Cargo, or any of the other package managers.

vintagedave 1y ago
The concern is not 'could' happen, but _does_ happen. I know this could occur in many places. But where it seems highly prevalent is NPM. And I am genuinely thinking to myself, is this making using npm a risk?
- cluckindan 1y ago
  Just use dependency cooldown. It will mitigate a lot of risk.
  - yoavm 1y ago
    If you started your Node project yesterday, wouldn't that mean you'd get the fix later?
    - cluckindan 1y ago
      Obviously you bypass the cooldown to fix critical issues.
    - flexd 1y ago
      no, because if you used dependency cooldown you wouldn't be using the latest version when you start your project, you would be using the one that is <cooldown period> days/versions old edit: but if that's also compromised earlier... \o/
- Ygg2 1y ago
  NPM is the largest possible target for such an attack. Attack an important package, and you can get into the Node and Electron ecosystem. That's a huge prize.
gred 1y ago
NPM has about 4 million packages, Maven Central has about 3 million packages. If this were true, wouldn't there have been at least one Maven attack by now, considering the number of NPM attacks that we've seen?
- AndroTux 1y ago
  Okay then, explain to me why this is only possible with NPM? Does it have a hidden "pwn" button that I don't know about?
  - deafpolygon 1y ago
    NPM executes packages as you download them.
  - liveoneggs 1y ago
    https://docs.npmjs.com/cli/v8/using-npm/scripts https://docs.npmjs.com/cli/v8/using-npm/scripts
  - tonyedgecombe 1y ago
    >Does it have a hidden "pwn" button that I don't know about? Perhaps its package owners do.
- viraptor 1y ago
  There were. They're just not as popular here. For example https://www.sonatype.com/blog/malware-removed-from-maven-central https://www.sonatype.com/blog/malware-removed-from-maven-cen... Maven is also a bit more complex than npm and had an issue in the system itself https://arxiv.org/html/2407.18760v4 https://arxiv.org/html/2407.18760v4
- skwee357 1y ago
  One speculation would be is that most Java apps in the wild use way older Java versions (say 17/11, while the latest will LTS is 21).
- chha 1y ago
  Been a while since I looked into this, but afaik Maven Central is run by Sonatype, which happens to be one of the major players for systems related to Supply Chain Security. From what I remember (a few years old, things may have changed) they required devs to stage packages to a specific test env, packages were inspected not only for malware but also vulnerabilities before being released to the public. NPM on the other hand... Write a package -> publish. Npm might scan for malware, they might do a few additional checks, but at least back when I looked into it nothing happened proactively.
PunchyHamster 1y ago
Value is one thing but the average user (by virtue of being popular) will be just less clued in on any security practices that could mitigate the problem.

The problem isn't specific to node. NPM is just the most popular repo so the most value for attacks. The same thing could happen on RubyGems, Cargo, or any of the other package managers.

vintagedave 1y ago

The concern is not 'could' happen, but _does_ happen. I know this could occur in many places. But where it seems highly prevalent is NPM. And I am genuinely thinking to myself, is this making using npm a risk?

cluckindan 1y ago
Just use dependency cooldown. It will mitigate a lot of risk.
- yoavm 1y ago
  If you started your Node project yesterday, wouldn't that mean you'd get the fix later?
  - cluckindan 1y ago
    Obviously you bypass the cooldown to fix critical issues.
  - flexd 1y ago
    no, because if you used dependency cooldown you wouldn't be using the latest version when you start your project, you would be using the one that is <cooldown period> days/versions old edit: but if that's also compromised earlier... \o/
Ygg2 1y ago
NPM is the largest possible target for such an attack. Attack an important package, and you can get into the Node and Electron ecosystem. That's a huge prize.

gred 1y ago

NPM has about 4 million packages, Maven Central has about 3 million packages. If this were true, wouldn't there have been at least one Maven attack by now, considering the number of NPM attacks that we've seen?

AndroTux 1y ago
Okay then, explain to me why this is only possible with NPM? Does it have a hidden "pwn" button that I don't know about?
- deafpolygon 1y ago
  NPM executes packages as you download them.
- liveoneggs 1y ago
  https://docs.npmjs.com/cli/v8/using-npm/scripts https://docs.npmjs.com/cli/v8/using-npm/scripts
- tonyedgecombe 1y ago
  >Does it have a hidden "pwn" button that I don't know about? Perhaps its package owners do.
viraptor 1y ago
There were. They're just not as popular here. For example https://www.sonatype.com/blog/malware-removed-from-maven-central https://www.sonatype.com/blog/malware-removed-from-maven-cen... Maven is also a bit more complex than npm and had an issue in the system itself https://arxiv.org/html/2407.18760v4 https://arxiv.org/html/2407.18760v4
skwee357 1y ago
One speculation would be is that most Java apps in the wild use way older Java versions (say 17/11, while the latest will LTS is 21).
chha 1y ago
Been a while since I looked into this, but afaik Maven Central is run by Sonatype, which happens to be one of the major players for systems related to Supply Chain Security. From what I remember (a few years old, things may have changed) they required devs to stage packages to a specific test env, packages were inspected not only for malware but also vulnerabilities before being released to the public. NPM on the other hand... Write a package -> publish. Npm might scan for malware, they might do a few additional checks, but at least back when I looked into it nothing happened proactively.

PunchyHamster 1y ago

Value is one thing but the average user (by virtue of being popular) will be just less clued in on any security practices that could mitigate the problem.