TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Embedded malware in RC (NPM package)

140 点作者 hjek超过 3 年前

17 条评论

greenyoda超过 3 年前
See also the ongoing discussion about malware in &quot;Coa&quot;, another NPM package: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=29116878" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=29116878</a>
评论 #29124011 未加载
schleck8超过 3 年前
And yet again, twice in a row this time.<p>Note how the referenced Virustotal result has 40+ detections [1]. I&#x27;m still wondering why info like this isn&#x27;t used by Pypi and NPM. Chocolatey has Virustotal integration for all releases.<p>And it&#x27;s not like Virustotal is the only option, there is Cape [2] for dynamic execution, Metadefender, and Intezer Analyze just to name a few.<p>Really confusing for such a vital supply chain component to be this easily abused.<p>One of the highlights is when someone recently used NPM to spread ransomware via a fake Roblox API package.[3]<p>[1] <a href="https:&#x2F;&#x2F;www.virustotal.com&#x2F;gui&#x2F;file&#x2F;26451f7f6fe297adf6738295b1dcc70f7678434ef21d8b6aad5ec00beb8a72cf&#x2F;detection" rel="nofollow">https:&#x2F;&#x2F;www.virustotal.com&#x2F;gui&#x2F;file&#x2F;26451f7f6fe297adf6738295...</a><p>[2] <a href="https:&#x2F;&#x2F;github.com&#x2F;kevoreilly&#x2F;CAPEv2" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;kevoreilly&#x2F;CAPEv2</a><p>[3] <a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;programming&#x2F;comments&#x2F;qgz0em&#x2F;fake_npm_roblox_api_package_installs_ransomware&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;programming&#x2F;comments&#x2F;qgz0em&#x2F;fake_np...</a>
评论 #29123753 未加载
评论 #29122956 未加载
评论 #29123672 未加载
tolmasky超过 3 年前
If you&#x27;re interested in preventing this sort of thing, I&#x27;d appreciate comments on this [RFC](<a href="https:&#x2F;&#x2F;github.com&#x2F;npm&#x2F;rfcs&#x2F;pull&#x2F;488" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;npm&#x2F;rfcs&#x2F;pull&#x2F;488</a>) I just submitted to npm to make install scripts <i>opt-in</i> instead of <i>default behavior</i>. While of course not perfect, this simple change would certainly go a long way in increasing the difficulty in creating these sorts of attacks, as right now as long as a computer even installs the packages in question, not even running any code in the package, the malicious program has a chance at running.<p>RFC: <a href="https:&#x2F;&#x2F;github.com&#x2F;npm&#x2F;rfcs&#x2F;pull&#x2F;488" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;npm&#x2F;rfcs&#x2F;pull&#x2F;488</a><p>Related HN post: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=29122473" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=29122473</a>
评论 #29123266 未加载
评论 #29124021 未加载
评论 #29124207 未加载
评论 #29123263 未加载
hn_throwaway_99超过 3 年前
One of the thing I wish was really much easier to do with NPM is, when running `npm update`, to only pick up the most recent compatible versions <i>from X days ago</i>.<p>That is, for sensitive apps, I <i>don&#x27;t</i> want to use versions that are less than, say, a month or so old unless I specifically override it. I want to stay up-to-date but not <i>too</i> bleeding edge, specifically to avoid situations like this.
评论 #29125871 未加载
评论 #29126328 未加载
binarynate超过 3 年前
This is why JS runtimes should add the ability to set permissions on a per-module basis. Deno is a step in the right direction by requiring permissions for a script to be specified (e.g. deno run --allow-read --allow-net myscript.ts), but the permissions are global for the entire script and can&#x27;t (yet?) be configured differently for each module &#x2F; dependency.
评论 #29125925 未加载
armchairhacker超过 3 年前
Genuinely curious: why is malware always discovered in npm packages, and not pip (python), gradle&#x2F;maven (JVM), cabal (Haskell), cargo (Rust), CRAN (R), etc.? Or are there major vulnerable packages in those repos but they just don&#x27;t get audited?
评论 #29128327 未加载
评论 #29127527 未加载
评论 #29128690 未加载
评论 #29129088 未加载
评论 #29128748 未加载
hjek超过 3 年前
More info: <a href="https:&#x2F;&#x2F;therecord.media&#x2F;malware-found-in-coa-and-rc-two-npm-packages-with-23m-weekly-downloads&#x2F;" rel="nofollow">https:&#x2F;&#x2F;therecord.media&#x2F;malware-found-in-coa-and-rc-two-npm-...</a>
评论 #29124831 未加载
cookiengineer超过 3 年前
Every time I see news like this, I am amazed by the absolute lack of permission management in nodejs and npm.<p>I mean, a package.json with changing permissions and an alert or manual confirmation step could&#x27;ve easily fixed this.<p>NPM is pretty much the definition of a security nightmare, because you cannot guarantee anything.<p>Any dependency down the tree can compromise anything upstream.<p>I think that package managers must offer build bots that use the source codes (git repositories) as sources of truth rather than their own packages. That&#x27;s the only way that comes to mind to guarantee that the publisher of the package is actually the same owner.<p>If a git repo changes, warn all users. If a permission changes, warn all users. If a header&#x2F;symbol file changes, warn all users.
BonoboIO超过 3 年前
Using npm is like russian roulette. Someday it makes your head hurt really bad!
qwerty2021超过 3 年前
I checked the readme of both those packages and I can&#x27;t for the life of me understand why would anyone use either of them.<p>Why the fuck do all these leftpad is-even hello-world tic-tac-toe packages have millions of downloads?
评论 #29122977 未加载
评论 #29122797 未加载
madjam002超过 3 年前
This is like the third one this week right?<p>I know people keep saying about post-install should be opt out but then malware will just wait for first run instead.<p>How about an option to refuse to install any packages that have been published in the past week&#x2F;2 weeks? That way hopefully malware like this would have been spotted before you end up running it locally.
评论 #29124753 未加载
评论 #29125520 未加载
bluefox超过 3 年前
Is the advisory genuine?<p>It links to the github repo, where the latest commit is from 2018 for version 1.2.8.<p>It links to npmjs page, that shows 48 versions, where the latest version is 1.2.8 from &quot;3 years ago&quot;.<p>Yet it has 1.2.9&#x2F;1.3.9&#x2F;2.3.9 for &quot;Affected versions&quot;.<p>Did npmjs &quot;revert&quot; these versions and any clue of their existence? The npmjs page links to dominictarr&#x27;s repository. The npmjs site doesn&#x27;t seem to have a &quot;who owns this package name&quot; besides the repository&#x2F;homepage links. Very confusing.<p>I remember some years ago there was some story involving the original author&#x27;s handing maintainership rights to some shady dude. Is it about that time, or is it about something more current?
评论 #29127691 未加载
评论 #29125067 未加载
greggman3超过 3 年前
Would it be better for package managers to default to staying at a fixed version? I know npm defaults to semver upgrades. You say<p><pre><code> npm install foo@3.1.7 </code></pre> And it, by default, inserts &quot;foo@^3.1.7&quot; which means &quot;anything 3.1.7 or higher but not &quot;4.x.x&quot;.<p>In other words, the next time someone installs the dependencies it could be 3.1.8, 3.9.7, 3.1234.999 etc...<p>But maybe it should default to just the actual version and all upgrades should be required to be manual. Checking my HD I see I have lots of references to &quot;rc@^1.1.6&quot;, &quot;rc@^1.2.8&quot; etc, all of which would install 1.2.9 if reinstall the deps
rndhouse超过 3 年前
I&#x27;ve created Vouch in an attempt to address this problem:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;vouch-dev&#x2F;vouch" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;vouch-dev&#x2F;vouch</a><p>Vouch lets users create and share reviews for NPM packages. Project dependencies can then be checked against those reviews.<p>Vouch uses extensions to interface with package ecosystems. It&#x27;s simple to create a new extension. Extensions currently exist for NPM, PyPi, and Ansible Galaxy.<p>I&#x27;m currently working on a website to index known reviews and publish official reviews.<p>I hope you guys find it useful! Drop by the Matrix channel if you have any feedback to share: #vouch:matrix.org
评论 #29124083 未加载
评论 #29124060 未加载
评论 #29124059 未加载
评论 #29124678 未加载
sva_超过 3 年前
Actually had this package installed somewhere...<p><pre><code> &quot;version&quot;: &quot;1.2.8&quot;, </code></pre> Pfew, really lucky. Going to nuke npm now.
ricardobayes超过 3 年前
Seems like a good choice to work at a cybersecurity company these days. Job security is guaranteed.
评论 #29125700 未加载
joshuanapoli超过 3 年前
How long were the compromised packages available from npm?