←back to thread

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

(socket.dev)
1208 points jamesberthoty | 4 comments | 16 Sep 25 11:22 UTC | HN request time: 0.462s | source
Show context
jbd0 ◴[16 Sep 25 11:50 UTC] No.45260954[source]▶
I knew npm was a train wreck when I first used it years ago and it pulled in literally hundreds of dependencies for a simple app. I avoid anything that uses it like the plague.
replies(3): >>45260975 #>>45261085 #>>45261124 #
zachrip ◴[16 Sep 25 12:03 UTC] No.45261085[source]▶
I can tell a lot about a dev by the fact that they single out npm/js for this supply chain issue.
replies(7): >>45261191 #>>45261219 #>>45261232 #>>45261237 #>>45261268 #>>45261512 #>>45263231 #
lithos ◴[16 Sep 25 12:21 UTC] No.45261268[source]▶
Just more engineering leaning than you. Actual engineers have to analyze their supply chains, and so makes sense they would be baffled by NPM dependency trees that utterly normal projects grow into in the JavaScript ecosystem.
replies(2): >>45261475 #>>45265112 #
1. zachrip ◴[16 Sep 25 12:45 UTC] No.45261475[source]▶
Do you think companies using node don't analyze supply chains? That's nonsense. Have you cargo installed a rust app recently? This isn't just a js issue. This needs to be solved across the industry and npm frankly has done a horrible job at it. We let people with billions of downloads a month with recently changed password/2fa publish packages? Why don't we pool assets as a collective to scan newly published packages before they're allowed to be installed? These types of things really should exist across all package registries (and my really hot take is that we probably don't need a registry for every language, either!).
replies(3): >>45262860 #>>45262989 #>>45269609 #
2. LaGrange ◴[16 Sep 25 14:36 UTC] No.45262860[source]▶
> Do you think companies using node don't analyze supply chains?

I _know_ many don’t. In fact suggesting doing it is a good way to be looked at like a crazy person and be told something like “this is a yes place not a no place.”

3. pclmulqdq ◴[16 Sep 25 14:44 UTC] No.45262989[source]▶
It is solved across the industry for those who care. If you use cargo, npm, or a python package manager, you may have a service that handles static versioning of dependencies for security purposes. If you don't, you aren't generally working in a language that encourages so much package use.
4. keyle ◴[16 Sep 25 23:25 UTC] No.45269609[source]▶
2FA would certainly help, however you'd still have malware like these silently updating code and waiting for the next release.

We'd have to rely on the developer to notice, and check every line of code they ship, which might be the norm but certainly not 100% of cases.