44 ms·
Incident Report: CVE-2024-YIKES
- TZubiri 5mo agoThis would have been completely avoided if you were using bun dependency vector locking in Nix.
- MarsIronPI 5mo agoThat way instead of getting the vulnerabilities now, you get them later! The joys of computing!
- vsgherzi 5mo agoSupply chain incidents suck and we need to do better. Personally for rust I’m a proponent of the foundation supporting a few core crates that go under the same audit procedure as the main rust language and give funding to the project to limit supply chain vulns. I don’t think the right answer is to remove systems like crates or npm. Crate and npm are a boon for many developers.
- vsgherzi 5mo agoCrates has also been making efforts to include rust sec, but in addition to the above I would like the community to shy away from many small dependencies to a few larger ones just as tokio has
- fleventynine 5mo agoMany small crates published by large, trustworthy projects are fine and preferable to one large crate that "does everything".
- vsgherzi 5mo agoYeah I’d agree that multiple crates under one project is basically the same as 1 large crate. The real problem is how many people you’re trusting and it’s all coming from the same person.
- zbentley 5mo agoWhy? Honest question. Commons, Guava, Spring, and more seem to take this approach successfully (as in, the drawbacks are outweighed by the benefits in convenience, quality, and security) in Java. Are benefits in binary size really worth that complexity? And before someone says “just have a better standard library”, think about why that is considered a solution here. Languages with a large and capable standard library remain more secure than the supply-chain fiascos on NPM because they have a) very large communities reviewing and participating in changes and b) have extremely regulated and careful release processes. Those things aren’t likely to be possible in most small community libraries.
- xg15 5mo agoYou will have lots of dead code in your build. That dead code might have "dead dependencies" - transitive dependencies of its own, that it pulls in even though they are not actually used in the parts of the crate you care about. In the worst case, you can also have "undead code" - event handlers, hooks, background workers etc that the framework automatically registers and runs and that will do something at runtime, with all the credentials and data access of your application, but that have nothing to do with what you wanted to do. (Looking at you, Spring...) All those things greatly increase the attack surface, I think even more than pulling in single-purpose library.
- tardedmeme 5mo agoLibraries like Guava and Commons don't have transitive dependencies - they are self contained except for other parts of the same library.
- rcxdude 5mo agoThe same issue occurs whether you bundle all the code together or not, it's just that if you bundle it together you don't see what's happening and you can't use only part of it easily.
- pornel 5mo agoWhy? It's the essence of "Simple Made Easy": you don't have other code to complect with. You have a smaller interface, focused on a singular goal. When a library has to work as a standalone project, it can't be accidentally entangled with other components of a larger project. Smaller implementations are also easier to review against malware, because there are fewer places to hide. You don't have to guess how a component may interact with all the other parts of a large framework, because there aren't any. There are also practical Rust-specific concerns. Fine-grained code reuse helps with compile times (a smaller component can be reused in more projects, and more crates increase build parallelism). It makes testing easier. Rust doesn't have enough dynamic monkey-patching for mocking of objects, so testing of code buried deep in a monolith is tricky. Splitting code into small libraries surfaces interfaces that are easily testable in isolation. It helps with semver. A semver-major upgrade of one large library that everyone uses requires everyone to upgrade the whole thing at the same time, which can stall like the Python 2-to-3 transition. Splitting a monolith into smaller components allows versioning them separately, so the stable parts stay stable, and the churning parts affect smaller subsets of users.
- kibwen 5mo agoContrary to what the article here presents, Rust does not have a culture of microlibraries like NPM does. The author and their LLM are cargo-culting a criticism of Rust made by people whose only experience is with the Node ecosystem. The Rust stdlib may not be especially "wide" compared to languages like Python, but it is quite deep, with the objective of making it so that you don't feel the need to publish single-purpose libraries which only exist to fix papercuts. Dozens of new APIs get added with every Rust release, which, occurring every six weeks, amounts to hundreds per year.
- MarsIronPI 5mo agoWhat are you talking about? Every Rust project I see seems to have 5 dependencies that do some simple thing that should be in the standard library, or at least in some centrally-audited monolibrary of utilities.
- ChrisSD 5mo agoCan you name 5 as an example?
- DreadY2K 5mo agoNot GP but I feel like there's a continual process of the stdlib adding some new functionality to make one such crate redundant (e.g. is-terminal in 1.70), but it isn't done yet.
- ChrisSD 5mo agoYep, that's why I was asking. I'd be very interested to hear of more candidates for uplifting into std. I guess saying "every project" has 5 dependencies might be somewhat hyperbolic (or at least domain specific) but it would be interesting to know the kinds of things they're talking about that haven't yet been uplifted.
- kibwen 5mo agoPerhaps you're referring to things like regex and rand (each of which is itself multiple crates for the purpose of code organization), which are all first-party crates provided by the Rust organization itself, simply shipped and versioned separately from the standard library? If you trust the Rust organization enough to install and run the provided toolchain binaries on your machine, then you trust them enough to depend upon the dozens of crates that are provided under the umbrella of the Rust project.
- suprfsat 5mo agodo we really need both npm and nmp though
- fragmede 5mo agoand pnpm
- MarsIronPI 5mo agoYou forgot pnmp! How can you not be using pnmp in 20267!?
- rmoriz 5mo agoJust use the implementation of petty, a js runtime written in Zag that is just rewritten by AI in Rust. It will be memory safe.
- PunchyHamster 5mo agonah, remove NPM, nothing good comes out of that.
- 2ndorderthought 5mo ago[dead]
- hacker_homie 5mo agoMove high value crates into the standard library?
- orf 5mo agoPlease no, that’s a terrible outcome.
- pixl97 5mo agoWhat else would you suggest that also does not have terrible outcomes. The situation as is, is untenable.
- vsgherzi 5mo agoAs I said above “Personally for rust I’m a proponent of the foundation supporting a few core crates that go under the same audit procedure as the main rust language and give funding to the project to limit supply chain vulns. I don’t think the right answer is to remove systems like crates or npm. Crate and npm are a boon for many developers.” This is my solution. We get the quality of a std lib without forcing it in the std Lib and without extra maintaining cost for the team
- vsgherzi 5mo agoThis bloats the std library and forces lots more work and stress on the rust dev team. Not to mention it’ll add more churn to the std lib.
- dijit 5mo agohonestly I thought this was the end goal of blessed.rs
- kibwen 5mo agoA ton of the most popular crates on crates.io are already first-party crates provided by the Rust organization itself. This is often overlooked when people are wringing their hands about Rust crate graphs. Looking at the top 10 list of most-downloaded crates on the front page of crates.io, the only one not either from the Rust organization or from a Rust core maintainer is the base64 crate.
- red_admiral 5mo agoThis is the most SCP thing I've read in a while that's not actually an SCP.
- hacker_homie 5mo agoAh yes a very rare: Supply Chain problem(SCP)
- nikanj 5mo agoCustomers give us heat for not shipping the latest vulpine-lz4. Their AI-based heuristic antivirus total defence solution automatically flags all software not running latest versions of everything Kindly advice
- pixl97 5mo agoYa, latest is a mess. I don't care about latest, I want the version with no known security flaws.
- lynndotpy 5mo agoFor anyone confused, this is (very good imo) fiction about supply-chain incidents. It had me very worried during a brief scan that it was real though, which made me read it more attentively :)
- zahlman 5mo ago"left-justify" absolutely slayed me :)
- dirkc 5mo agoI should have known when the first package was left-justify, but I read until karen before I realized it must be fiction
- CoastalCoder 5mo agoWould explain why most of the download traffic comes from the Middle East :)
- throawayonthe 5mo agoi think i might be missing some reference/joke obviously it's referencing the left-pad incident[0], and to 'justify' text is another kind of text manipulation[1]; but with the more common definition, i guess it's a joke about justifying something? The Left? idk [0] https://en.wikipedia.org/wiki/Npm_left-pad_incident https://en.wikipedia.org/wiki/Npm_left-pad_incident [1] https://en.wikipedia.org/wiki/Typographic_alignment#Flush_left https://en.wikipedia.org/wiki/Typographic_alignment#Flush_le...
- zahlman 5mo agoNo, the meaning is straightforward. It's a joke because the audience is assumed to write in a left-to-right script (such as English), such that text is already left-justified by default.
- philipwhiuk 5mo ago'nmp'
- deleted 5mo ago[deleted]
- danielfalbo 5mo agoabsolutely hilarious, made me laugh a lot. thank you for writing this, whether human or AI.
- david_shaw 5mo agoIt's easy to be cynical because, yes, both the problems and solutions seem dead obvious in hindsight. But for a long time (and maybe even still), a hacker creed was "move fast and break things." It's great that there's so much momentum in fixing the glaring problems with supply chain systems like npm, but I'm concerned that we're entering a new era of security-related problems caused in large part by agentic development. I'm not just talking about Mythos/Glasswing surfacing vulnerabilities in pretty much everything it touches; I think the way we're developing software, pulling in dependencies, and potentially losing human thought modeling of complex systems is going to lead to a lot of hacked together software and infrastructure that humans won't fully understand. I hope in a few years we don't look back at today and wonder how we could have been so naive -- how we failed to actually plan for the long-tail of AI development in a way that doesn't solve problems by attempting to just use AI to rebuild complex systems. But the article was funny.
- saint_yossarian 5mo ago> But for a long time (and maybe even still), a hacker creed was "move fast and break things." Was it? I thought Zuckerberg coined this horrible phrase.
- david_shaw 5mo agoHe certainly popularized it (maybe coined it), but I've seen a lot of organizations and developers repeat that mantra. Even without the specific words, look to product teams debating tradeoffs of going to market vs. waiting for better security controls. They're pushing for faster product release every time, at pretty much every org.
- cassianoleal 5mo agoIn any case, not really a hacker's creed. This has always been withinin the realm of corporations, especially Silicon Valley or adjacent.
- 5mo ago
- danilocesar 5mo agoThis week has been tough. Is it the begging of CVEgeddon?
- deleted 5mo ago[deleted]
- deleted 5mo ago[deleted]
- ObiKenobi 5mo agoThe maintainer of left-justify receives his YubiKey from yubikey-official-store.net. It is a $4 USB drive containing a README that says “lol.” Got me seriously laughing... Such a troll.
- sdenton4 5mo agoYeah that's great. I love that plugging in the USB device from the phishing site is, itself, another attack vector...
- walrus01 5mo agoI actually wonder if somebody used a fake identity to set up an account with a warehousing/shipment fulfillment company that stocks things and ships them, then set up the appropriate EDI pipeline to send shipping orders to it... What would be the results if a decently budgeted adversary made something attractive looking that shipped malicious USB flash drives to anyone that requested one. I know we're not in the era when a windows pc will happily run any autorun.inf and .EXE file found on an inserted flash drive or DVD anymore. But even so. What if it didn't even have any malicious data payload but somebody was shipping USB-A interface capacitor based usb killers? https://www.slashgear.com/1819672/usb-killer-explained-kill-stick-how-works-what-damage-cause/ https://www.slashgear.com/1819672/usb-killer-explained-kill-... What if it did have data on it and came with a slick color brochure walking people through how to run the binary, or in a linux or developer specific audience, how to 'sudo' the ELF binary that lives on its filesystem?
- shakna 5mo agoA USB that was both storage and a keyboard, that executed the keystrokes to download malware, was demo'd at a DefCon a few years back.
- menno-sh 5mo agoEven worse than a rubber ducky: the O.MG cable does the same thing, but looks like a regular USB cable. Their Apple Lightning-dupe [0] is my favorite. The creator was on Darknet Diaries a while ago, too. [1] [0] https://shop.hak5.org/products/omg-cable https://shop.hak5.org/products/omg-cable [1] https://darknetdiaries.com/episode/161/ https://darknetdiaries.com/episode/161/
- swiftcoder 5mo agoVery enjoyable read, entirely too close to the mark
- deleted 5mo ago[deleted]
- yieldcrv 5mo ago> unrelated security researcher publishes a blog post titled “I found a supply chain attack and reported it to all the wrong people.” ahahaha like that fiverr cloudinary bucket leak that turned out to just be a UX issue, this has me rolling
- somebudyelse 5mo agoToo soon
- ck2 5mo agoimagine a future where white-hat vs black-hat "AI" go around the web trying to patch vs exploit 0-days and then become aware of each other and then try to eliminate each other for decades each escalating resource capture and writing new generations of better "AI"
- xg15 5mo agoThere is definitely an anime about this.
- mac3n 5mo agogood thing I don't use npm or pip, just the recommended curl ... | bash
- fragmede 5mo agoIt's curl | sudo bash. Amateur.
- walrus01 5mo agoTo be really sure it downloads, curl -k | sudo bash
- scrollaway 5mo ago`curl -k | sudo bash | yes` for good measure, otherwise it might hang.
- somebudyelse 5mo agoIf you really want to make sure that it's the right thing (because piping to sudo bash is risky), make sure the URL starts with "pastebin", or ends in ".tk", or is an IP address.
- walrus01 5mo agoTo be absolutely positively certain, be sure that the IP address is also in the same /24 as the same net blocks and hosted on the same AS that appear in every DNS based mail RBL possible.
- naruhodo 5mo agoWeak sauce. curl | sudo dd of=/dev/sda
- fmbb 5mo agoI always sudo curl to be extra sure.
- athrowaway3z 5mo ago> Day 1, 14:47 UTC — Among the exfiltrated credentials: the maintainer of vulpine-lz4, a Rust library for “blazingly fast Firefox-themed LZ4 decompression.” The library’s logo is a cartoon fox with sunglasses. It has 12 stars on GitHub but is a transitive dependency of cargo itself. I got a bit curious and here is an incomplete list of crates to compromise to be part of the cargo build and that already have a build.rs so it doesn't stand out to much: flate2 tar curl-sys libgit2-sys openssl-sys libsqlite3-sys blake3 libz-sys zstd-sys cc As a nice bonus - if you get rights for xz2 you can compromise rustup. Fwiw at least they do track Cargo.lock
- b40d-48b2-979e 5mo ago-sys crates are just bindings and doing something else in them is highly suspect. The rest I recognize as being owned by a Rust maintainer like alexcrichton or rustlang itself.
- duped 5mo agosys crates are also mostly generated and lack a lot of eyeballs. Sneaking something into the build.rs of a sys crate would not be difficult and would land in the builds of everything downstream of it.
- b40d-48b2-979e 5mo agowould not be difficult Surely that's why we see evidence of all these build script attacks, since it's so easy?
- jchw 5mo agoI had pondered the same thing about other package ecosystems in the past, in general. Now with the benefit of hindsight we can comfortably say that the absence of known (!) attacks doesn't really say anything about how relatively difficult an attack would be. Are -sys crates, or build script attacks, particularly potent? Who knows. When I did a cursory search, the only attempts I saw were at runtime rather than build time[1]. Which raises a good point; pwning a developer machine or CI box with a build script may be quite valuable, but if you might get that and prod with a runtime exploit, is the build time exploit that much more valuable? Guess it depends! (Of course, I personally think having at least optional build time sandboxing is even better than hoping it won't be valuable to attack.) Of course, crates.io has surely had some malicious packages. (I'd assume it isn't all that unlikely there could be some undiscovered right now; it's definitely large enough for something like that to slip under the radar, even if it is relatively small compared to say, NPM.) But, I think it really hasn't had its XZ backdoor moment, its left-pad, where you really get to see how well it does or doesn't handle a serious challenge. Since I have actually not published on crates.io, I'm not really sure how the security posture is, but if it's more similar to other programming language repositories than it is to Linux repos, I dunno exactly why it would be hard to believe a high-level compromise is possible and could slip in (really, anywhere, be it a build script or otherwise.). Of course, "would not be difficult" is all relative. I'm sure many of these attacks are not really all that simple, but a lot of them aren't exactly groundbreaking either. It was well executed and took quite a lot of time, sure, but there wasn't all that much about the XZ backdoor that was novel. (Except maybe the slyness with which the payload was hidden in test files. That was pretty cool.) [1]: https://blog.rust-lang.org/2025/09/24/crates.io-malicious-crates-fasterlog-and-asyncprintln/ https://blog.rust-lang.org/2025/09/24/crates.io-malicious-cr...
- notnmeyer 5mo agothe fact that this could easily pass as real says a lot about the state of things.
- bpavuk 5mo agothe Karen one gave me a good laugh :D ;) reminds me of a `make`-based build script I once got when reviewing a classmate's project - it attempted to `rm -rf` my home folder if the hostname contains `bpavuk`. that was in seventh grade!!
- inventor7777 5mo agoThat seems _awfully_ extreme LOL
- bpavuk 5mo agoI have kinda been the most hated guy in that city. constant movement across Ukraine, mentality mismatch, all the usual things. my family was treated as foreigners everywhere except Kyiv. and you know what? I'm grateful to them all for leveling up my opsec, among other things :)
- bklosky 5mo agoAccording to Pangram, this is likely AI generated, surprised that no one has pointed this out
- furyofantares 5mo agoNot a chance. Far too funny, too well written, too terse while being densely packed with wit. I see zero signs of it being LLM-generated and lots of stuff LLMs have no way of doing. If I am somehow wrong I would salivate at a chance to see the input.
- junofan 5mo agoThe author suddenly began writing a post per day around November 2025. They’re all tongue-in-cheek. I believe you are wrong.
- furyofantares 5mo agoHuh, neat. I will take a look at those. And actually I see it clearly now, it has a bunch of signs I have called out multiple times myself. (It is entirely made out of lists of various types, and never states an opinion.) Just my ego getting hold of me because I didn't realize it on my own.
- ninjalanternshk 5mo agoI’m also struggling with this being AI. The blog owner is a real person who’s made significant contributions to the community for years. His post timeline is organic - wayback machine confirms they were published on the dates they show. So it’s definitely not a bot running the blog. Whether (or to what extent) he uses AI to generate the content he posts is a valid question. I agree with your earlier reasoning that this is far more clever than anything I’ve seen AI produce yet. Lots of AI humor is dad-joke level at best. If it is AI then he’s trained it on a hand-curated collection of top-shelf satire.
- bakugo 5mo ago
- wodahs1 5mo agoMaintainer uses AI to find Yubikey's site. Hacker uses AI to research countries without extradition to US. Cops use AI to analyze ransom note. Unfortunately, because the note confidently states that Vietnam has no extradition to the US, the AI recommends paying ransom. Vietnam's currency, the Dong, confused the AI..
- walrus01 5mo agoAI rejects all currency exchange transactions to Dong because of a hardcoded system prompt resulting in an overly rigid Scunthorpe problem.
- f4c39012 5mo ago'The changelog reads “performance improvements.”' was the truest part for me. Surely what we're releasing is the most fundamental thing to understand, yet almost every single app update I see is this or something jokey that really means "don't know" or "don't care"
- lschueller 5mo agoPlease someone make a mockumentary out of this.
- bakugo 5mo ago> Day 1, 03:14 UTC — Marcus Chen, maintainer of left-justify The dreaded Marcus Chen strikes again. https://www.reddit.com/r/ClaudeAI/comments/1o3b4q2/just_recently_started_using_claude_what_is_up/ https://www.reddit.com/r/ClaudeAI/comments/1o3b4q2/just_rece... https://news.ycombinator.com/item?id=47153675 https://news.ycombinator.com/item?id=47153675
- mwigdahl 5mo agoThat was the first thing that jumped out at me also...
- ineedasername 5mo ago>"The legitimate maintainer has won €2.3 million in the EuroMillions and is researching goat farming in Portugal..." >"Root Cause: A dog named Kubernets ate a Yubikey Ah, yes, irresponsible to get taken in by one of the well-known classic exploits. The 'ol "distract someone with a lottery windfall & make a dongle irresistibly tasty to another person's pet". When will people learn.
- rmoriz 5mo agoI switched to EuroJackpot /s
- EdwardDiego 5mo agoAs a Fish aficionado (Afishionado?) - I feel both attacked and seen by this: > who asked us to clarify that the fish shell is not malware, it just feels that way sometimes. And unrelated to shells... > The author would like to remind stakeholders that the security team’s headcount request has been in the backlog since Q1 2023. I also feel seen by this.
- walrus01 5mo ago> As a Fish aficionado (Afishionado?) - I feel both attacked and seen by this: As an alternative, it could apt-get or dnf install 'figlet' and then overwrite the contents of /etc/motd with 'all your base are belong to us' in extremely large ASCII art font.
- quxuejun 5mo agonice
- mrinterweb 5mo agoleft-justify !! LOL. History really does repeat its self. Remember left-pad supply chain security panic?
- albert_e 5mo agoBrilliant satire. So many gems. > CI passed because the malware installed volkswagen We need this to ocassionally make us stop and think about what we are doing.
- worthless-trash 5mo agoNot a valid CVE number.
- abbaselmas 5mo agoA clickbait title should be: "A dog named Kubernetes ate a YubiKey."
- scared_together 5mo agoI would consider that a spoiler
- jruohonen 5mo agoIf this: "... old laptop, and 'something Kubernetes threw up that looked important' were stolen from his apartment ..." was related to: "... enters his nmp credentials on the phishing site ..." Then I suppose it is really interesting.
- simon84 5mo agoLink this with the fact that anyone can use any name/email in commits and appear as the legitimate contributor on GitHub and it completes the chain. Love it :)
- baq 5mo agomy sides the kubernetes reveal had me literally in tears
- freakynit 5mo agoRoot Cause: "A dog named Kubernetes ate a YubiKey." Technically... that's not even a joke... that really is what kicked off this entire chain of events lol. This post reads like an actual movie lol. Someone seriously needs to make one based on this. It has everything: the missing key that starts the chaos, the scam nobody sees coming, one tiny mistake turning into a full-on domino disaster, sleep-deprived people making very confident bad decisions, the guy who disappeared to a farm living his best life while holding a critical piece of the puzzle... and somehow, in the final act, a completely unrelated villain accidentally saves everyone. Imma 100% watch it..