←back to thread

Malicious versions of Nx and some supporting plugins were published

(github.com)
441 points longcat | 4 comments | 27 Aug 25 01:38 UTC | HN request time: 0.245s | source
Show context
inbx0 ◴[27 Aug 25 14:33 UTC] No.45040282[source]▶
Periodic reminder to disable npm install scripts.

    npm config set ignore-scripts true [--global]
It's easy to do both at project level and globally, and these days there are quite few legit packages that don't work without them. For those that don't, you can create a separate installation script to your project that cds into that folder and runs their install-script.

I know this isn't a silver bullet solution to supply chain attakcs, but, so far it has been effective against many attacks through npm.

https://docs.npmjs.com/cli/v8/commands/npm-config

replies(17): >>45040489 #>>45041292 #>>45041798 #>>45041820 #>>45041840 #>>45042872 #>>45043977 #>>45045311 #>>45045447 #>>45045979 #>>45046082 #>>45046981 #>>45047430 #>>45047994 #>>45049197 #>>45049793 #>>45050820 #
1. eitau_1 ◴[27 Aug 25 16:29 UTC] No.45041820[source]▶
Why the same advice doesn't apply to `setup.py` or `build.rs`? Is it because npm is (ab)used for software distribution (eg. see sibling comment: https://news.ycombinator.com/item?id=45041292) instead of being used only for managing library-dependencies?
replies(3): >>45041933 #>>45046598 #>>45050487 #
2. ivape ◴[27 Aug 25 16:39 UTC] No.45041933[source]▶
It should apply for anything. Truth be told the process of learning programming is so arduous at times that you basically just copy and paste and run fucking anything in terminal to get a project setup or fixed.

Go down the rabbit hole of just installing LLM software and you’ll find yourself in quite a copy and paste frenzy.

We got used to this GitHub shit of setting up every process of an install script in this way, so I’m surprised it’s not happening constantly.

3. username223 ◴[27 Aug 25 23:35 UTC] No.45046598[source]▶
It should, and also to Makefile.PL, etc. These systems were created at a time when you were dealing with a handful of dependencies, and software development was a friendlier place.

Now you're dealing with hundreds of recursive dependencies, all of which you should assume may become hostile at any time. If you neither audit your dependencies, nor have the ability to sue them for damages, you're in a precarious position.

4. ifwinterco ◴[28 Aug 25 10:29 UTC] No.45050487[source]▶
For simple python libraries setup.py has been discouraged for a long time in favour of pyproject.toml for exactly this reason