←back to thread

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

(socket.dev)
1208 points jamesberthoty | 1 comments | 16 Sep 25 11:22 UTC | HN request time: 0s | source
Show context
Meneth ◴[16 Sep 25 12:25 UTC] No.45261303[source]▶
This happens because there's no auditing of new packages or versions. The distro's maintainer and the developer is the same person.

The general solution is to do what Debian does.

Keep a stable distro where new packages aren't added and versions change rarely (security updates and bugfixes only, no new functionality). This is what most people use.

Keep a testing/unstable distro where new packages and new versions can be added, but even then added only by the distro maintainer, NOT by the package developers. This is where the audits happen.

NPM, Python, Rust, Go, Ruby all suffer from this problem, because they have centralized and open package repositories.

replies(25): >>45261528 #>>45261617 #>>45261792 #>>45262591 #>>45262655 #>>45262978 #>>45263089 #>>45263137 #>>45263570 #>>45263728 #>>45264113 #>>45264189 #>>45265297 #>>45266032 #>>45266873 #>>45267343 #>>45268626 #>>45268669 #>>45269007 #>>45269777 #>>45270131 #>>45270753 #>>45272097 #>>45273282 #>>45273471 #
SkiFire13 ◴[16 Sep 25 14:19 UTC] No.45262591[source]▶
> Keep a stable distro where new packages aren't added and versions change rarely (security updates and bugfixes only, no new functionality). This is what most people use.

Unfortunately most people don't want old software that doesn't support newer hardware so most people don't end up using Debian stable.

replies(5): >>45263830 #>>45263936 #>>45264687 #>>45267821 #>>45269435 #
bpt3 ◴[16 Sep 25 15:45 UTC] No.45263830[source]▶
What hardware isn't supported by Debian stable that is supported by unstable?

Or is this just a "don't use Linux" gripe?

replies(1): >>45268074 #
1. BoredPositron ◴[16 Sep 25 21:08 UTC] No.45268074{3}[source]▶
I haven't had much problems prior but Blackwell support was really buggy for the first two weeks.