Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

https://safedep.io/mini-shai-hulud-strikes-again-314-npm-packages-compromised/

by theanonymousone • 2 months ago

391 313 2 months ago

safedep.io

moi2388• 2 months ago

Because of course it’s npm

type0• 2 months ago

Does npm stand for "newly packaged malware"?

wolfi12• 2 months ago

should be a meme

Ygg2• 2 months ago

Akshully, "Node Packaged Malware."

matheusmoreira7• 2 months ago

Every programming language package manager is affected. Any random person can sign up and push packages. They are all equivalent to the Arch Linux User Repository and have the exact same caveats.

grey-area• 2 months ago

I last added a new dependency to a large project I work on a couple of years ago. So no, not all ecosystems are the same.

The culture makes a difference.

stephenr4• 2 months ago

How many other languages of any kind have a standard library that is so bizarrely lacking as JS?

Now how many other mainstream languages of any kind have a standard library that is so lacking?

Now how many other mainstream languages have a swathe of front-end developers that suddenly realised they can run code in a CLI or on a server, and spent exactly 0 minutes learning about how to make it not shit?

Now how many other languages get used in scenarios where it makes absolutely zero sense because the developer only knows javascript?

fnoef3• 2 months ago

I’m honestly at a point where I’m afraid to update any of my project’s dependencies, and I’m also afraid to run the locally without some locked down VM

exiguus• 2 months ago

I also was at this point, and I decided to add cooldowns to every project.

fnoef3• 2 months ago

Yeah, I agree, but then you are at the mercy of whatever vulnerability is found in the current version(s). It just feels like a lose-lose situation no matter what you do.

darkwi11ow• 2 months ago

I use Tanstack in my projects. Last week when Tanstack got compromised, it was only my laziness that saved me -- was thinking about doing pnpm upgrade but got lazy and played some dota... Finished game was just going to pnpm upgrade, opened hacker news and boom! news hit.

Since then, I had set up libvirt/qemu based VM with another Linux running in it specifically for development. Now I run all of docker, kubernetes, IDE, pnpm, uv, etc in that VM and removed them from host. The only write capable secret VM has access to, is my passphrase protected ssh key, which I can quickly revoke from my Github account in case of compromise. Feels much safer now.

wlkr• 2 months ago

At this point I would very much like to get off Mr Bones' Wild Ride but I fear this is going to continue to happen because, from my own exploration at least, a large number of commercial detection strategies are directed at the repo/device/developer level when loading/using a package.

This seems analogous to how we tackle email spam and general malware. It means that there is almost always a target valuable enough for bad actors to continue trying. However, unlike email (mostly...), package managers are centralised authorities (and anything out-of-band is surely the developers problem?).

My ill-informed feeling is that we might need to change the culture of lazy versioning with rapid releases and focus on stable, deeply scanned versions at registries. There will be some effect of volume and scale so I could be off, but it still seems telling that this impacts high-churn languages more often.

I don't know, I would love a comprehensive article that explores the landscape right now.

cess11• 2 months ago

Wondering about Mr Bones' Wild Ride and suspecting it might be a reference to the 1991 movie Nothing But Trouble I took a look, and found I had remembered it wrong.

The roller coaster in that movie was called Mr Bonestripper, https://www.youtube.com/watch?v=NEZEgd8GjJc .

Instead it comes from Roller Coaster Tycoon 2, https://knowyourmeme.com/memes/mr-bones-wild-ride .

As for the comparison with spam, there we kind of settled on making people accept spam by vacuuming up their email addresses in pretty much every commercial and social computer network setting, giving it a veneer of legitimacy. I think it is likely to happen in this area too, perhaps some combination of Oracle licensing surveillance agent style software and automated dependency management, i.e. 'solving' supply chain malware by whitelisting some other malware.

breezerbottles• 2 months ago

There's also Mr. Toad's Wild Ride at Disney parks, https://en.wikipedia.org/wiki/Mr._Toad%27s_Wild_Ride

tardedmeme2• 2 months ago

People who were born when this meme was current are 13 years old today. Time sucks. Time really sucks.

ares623• 2 months ago

If you think about it, this is actually a new kind of security. Security by numbers. Overwhelm the attackers with so many compromised services and devices that they get a reverse denial of service. It's inspired by nature in herd animals.

throwa356262• 2 months ago

Security by giving up

mentalgear4• 2 months ago

The situation is getting crazy ... personally I have already uninstalled node, python and all package managers from my machine and instead only use them in devcontainers / VMs.

But even if the dev community comes up with super hardened security, I fear in at least a year the models will be good enough in social engineering that we are still running a losing game.

wolfi12• 2 months ago

how do containers solve the problem? if they are connected to the internet (and they are) you have got the same problem, if the credentials can be read by the container, at least to my understanding

mentalgear4• 2 months ago

For credential stealing, that is true, but at least it would protect your local machine. But I just read these worms also try container escape ...

jcgl5• 2 months ago

On my personal machine, I run OpenSnitch. Much better defense against data exfil if you reject outbound connections to unexpected/unwanted hosts.

TacticalCoder• 2 months ago

Watertight subdivision in a ship doesn't promise: "there'll never ever be water in this ship". It says: "If there's water in this ship due to one hole, it'll stay in one compartment". Note that I said one hole: you have the titanic, many compartment gets holes, that one ship is still going to sink.

(btw that the Titanic sunk is not an excuse not to secure other ships. And it did save a great many other ships to have watertight subdivision.)

So... Although there are exploits escaping containers and VMs and then bad guys doing lateral moves across machines, you still want defense in depth.

CGamesPlay• 2 months ago

Things on my workstation that the container does not have access to: browser cookies, 1Password cli, SSH keys (even if I allow the SSH agent socket), cargo publish tokens (unless it’s a rust project), npm tokens (unless it’s an npm project), and not to mention anything relating to my other clients (don’t compromise my employer when I vibe install some dep for a random side project).

HWR_14• 2 months ago

Without node, how do you control your cloud resources? Cloudflare requires wrangler. AWS has a lot of node clis. Etc.

anygivnthursday2• 2 months ago

From CI pipelines with pinned package versions and OIDC instead of permanent secrets limited, least privileges.

rubiquity• 2 months ago

AWS has CLIs and SDKs in many languages.

zahlman6• 2 months ago

the models will be good enough in social engineering

Never mind questions of how good the models will/can get. I'm confused why people expect that, in principle, models getting really good at social engineering would have such huge impact. Seems to me like it has diminishing returns and is severely bottlenecked by the fact that the target operates at human speed.

The amount of effort involved in the XZ hack, for example, was immense, and it couldn't have been accelerated because it worked specifically by wearing the existing maintainer down over time. You could generate and send all the necessary nastygrams in seconds and it wouldn't speed up the human consuming them (and in fact, having all of them arrive at once would raise suspicion).

And there is a limit to how persuasive that input can be. Take any of the random nastygrams directed at the XZ maintainer; maybe they could have been made more nasty, more pointed, more aware of the maintainer's personal weaknesses and fears — but would that have actually been overall more effective? I think not, or at most only a tiny bit.

Terr_• 2 months ago

I'm imagining an influence campaign where someone weaponizes targeted advertising and recommendation engines against Mr. Trusted Maintainer, so that it's a The Truman Show effect, where the background of their entire digital bubble pushing the idea that they need retire and delegate.

mentalgear4• 2 months ago

Docker Container Escape
The payload checks for the Docker socket and, if present, attempts container escape through three sequential methods:

So even if you're running devcontainers / VMs, these worms are already trying to escape.

Make sure you're running a rootless VM engine (e.g. podman instead of docker) !

jeswin3• 2 months ago

Make sure you're running a rootless VM engine (e.g. podman instead of docker) !

Aren't most people running docker rootless (at least on Linux)? Does podman do more?

Maakuth• 2 months ago

The docker CLI tool is normally executed with user privileges, but there's dockerd, a daemon running as root that actually does the container execution.

mayama• 2 months ago

docker service that sets up containers runs as root. podman does away with that service.

throw0101c3• 2 months ago

Aren't most people running docker rootless (at least on Linux)? Does podman do more?

In the HPC space Apptainer (previously "Singularity") was created precisely due to (multi-)user-level access, especially with the use of NFS.

perlgeek• 2 months ago

I'd guess that most people who run Docker on linux install it through their distro's package manager, which has a dockerd running as root.

On Debian derivatives, you need some kind of extra privs to even talk to it (being a member of the "docker" group, iirc).

moebrowne• 2 months ago

Or don't mount the Docker socket into containers

ErroneousBosh4• 2 months ago

Or mount it read-only if you do, like for Traefik.

vsgherzi• 2 months ago

I really wish we would’ve gotten something more like jails or zones. Or better yet put the containers in a jail or zone. Is there a comprehensive sandbox for Linux like the bsds have?

Havoc2• 2 months ago

Unprivileged LXCs get pretty close. Less unified design wise but on some aspects better - kernel escape doesn’t land you on a 0 UID

dboreham• 2 months ago

Worth noting that cgroups (kernel feature underlying containers) is "something more like jails or zones". Actually it is "something exactly like jails or zones".

cyanydeez5• 2 months ago

i wish opencode would have a protocol that puts real guardrails around its agents. rather that gaving to try and transplant weve had ssh for decades, surely you can wire a xomms pathway that cant deciate.

mentalgear4• 2 months ago

You may run

podman info --format '{{.Host.Security.Rootless}}'

to ensure podman is rootless in your config.

matheusmoreira7• 2 months ago

Why not run a proper virtual machine?

agrounds• 2 months ago

I dunno, why own a car when you could ride your bike instead? They’re just different things and people may choose to use one over the other for a variety of reasons.

waz0wski• 2 months ago

That's the direction container runtimes are trending

Amazon has been doing it with Firecracker for a while and Kata containers is another popular one

https://github.com/firecracker-microvm/firecracker

https://github.com/kata-containers/kata-containers

throw0101c3• 2 months ago

Why not run a proper virtual machine?

Extra 'overhead' and heaviness (perceived or real).

ahknight• 2 months ago

The joys of running podman/docker on macOS: you can't help but run it in a hypervisor.

mapontosevenths2• 2 months ago

Despite what some people will tell you (including many in the security indistry), Docker is not a strong security boundary, and it should not be treated as one. It shares a kernel with the running system.

It reminds me of the good old days when people would hand out low privilege Linux accounts and rely on the kernel to prevent privilige escalation. Docker is literally the same thing, just with extra steps. Especially today with new kernel LPE'S dropping every 5 minutes.

Yes, Podman is a bit better because you arent handing the attacker root, but... why hand them an account at all? Just use a grown up VM.

beardedwizard2• 2 months ago

Yeah because I'd rather trade one kernel surface for another.

throw0101c3• 2 months ago

Despite what some people will tell you (including many in the security indistry), Docker is not a strong security boundary, and it should not be treated as one. It shares a kernel with the running system.

Solaris Zones and FreeBSD Jails (their inspiration) also share a kernel with the running system and do not seem to have as many escape vulnerabilities.

(Though partly because there may not be as much scrutiny of course.)

pezgrande• 2 months ago

Only works if the Docker socket is mounted which is pretty stupid thing to do and also not something you would do in a "frontend" container. Essentially is like having a password-less ssh

MattCruikshank• 2 months ago

I've been toying with using Jart's Blink, the "tiniest x86-64-linux emulator". If it were hardened against attacks by a smart community, it seems really attractive...

Then I've been toying with using WASM, with a strictly limited API surface... (API stands for what, "Attack, Please, Infiltrators"?)

I'd really love to make a service which can run "untrusted" code... I want this to exist. I want it to feel like the Sandstorm.io marketplace, and to use Tailscale or something like it... and then to make "Facebook but only for friends or friends-of-friends." No public figures. No random people or ads in my feeds. Just friends. And then other similar apps - mail, discord, etc. Don't let it make outbound HTTP connections. Don't let it access local filesystem, other than assets that were bundled with it. Give it a SQLite API... And let it handle inbound HTTP, REST, WebSocket requests... And use gRPC over Tailscale to only talk directly to approved contacts...

Thoughts? How to run untrusted code safely?

I tried using Firecracker and gVisor... But I'm dissatisfied with them. I was trying to make it easy for someone to download and run my service... But Firecracker and gVisor don't at all feel like "libraries that install cleanly." They feel more like, if you're enterprise scale, you can hire someone to make sure Firecracker and gVisor work the way you want... Maybe I'm just not trying hard enough... Maybe using WSL2 on Windows 11 is just asking for trouble. I tried several different ways to run Linux on Windows, and none of them seemed very happy, when I tried to add Firecracker / gVisor.

zahlman6• 2 months ago

the good old days when people would hand out low privilege Linux accounts and rely on the kernel to prevent privilige escalation.

... Did that actually stop?

... Is that not the purpose of being able to make multiple accounts (even on a random desktop or laptop system) and restrict their privileges?

staticassertion4• 2 months ago

Docker is a lot more than just an unprivileged user. In particular, it comes with a seccomp filter. A lot of LPEs are blocked by that filter. Docker is actually a quite decent security boundary - in this case the attackers did not attempt to subvert docker by attacking the kernel attack surface, they attacked a weak configuration via the docker socket being mounted.

The reason you don't use a "grown up VM" is because it's significantly more difficult. Which VM? Firecracker requires KVM and a guest operating system - so how are you getting things in and out in a way that doesn't violate security? That's real work.

gVisor is great and my recommendation, certainly, but the difference between "nothing" and "docker" is actually pretty huge imo.

evertheylen• 2 months ago

I rely on podman for my "devcontainers": https://github.com/evertheylen/probox. If anyone can point me to the weak points in my setup I'd appreciate it!

jonkoops• 2 months ago

Another day, another pre/postinstall script executed that could have easily have been prevented by any sane package manager. NPM really desperately needs an 'allowBuilds' style allowlist [1] and 'approve-builds' command [2].

1. https://pnpm.io/settings#allowbuilds

2. https://pnpm.io/cli/approve-builds

wereHamster• 2 months ago

After I upgraded pnpm to v11, I set all allowBuilds to false and have not observed any failures. Made me wonder why the packages even need build scripts. My guess is for obscure or old platforms, but for most users running on Linux or Darwin build scripts seem to be unnecessary.

Tade0• 2 months ago

Made me wonder why the packages even need build scripts.

Historically it was to accommodate packages like the original SASS compiler:

https://sass-lang.com/ruby-sass/

Other times it was to avoid shipping binaries due to, erm, safety concerns. The package would include code in a different language, which in turn would compile into a binary library or executable.

n_e• 2 months ago

Made me wonder why the packages even need build scripts

As the name implies it's for building stuff. Most (all?) packages that use C++ FFI with node-gyp need it. A popular package that needs it is re2.

Many newer packages bundle prebuilt native code as transitive dependencies, so build scripts are less needed than before.

perkovsky• 2 months ago

Agree. Postinstall scripts should be explicit opt-in, not ambient capability.

Most packages should not need arbitrary code execution during install. And when they do, that should be obvious during review.

The default should probably be: install files, don’t run code.

Rohansi2• 2 months ago

If postinstall scripts are restricted the people behind these attacks will switch to something else. Package code is executed automatically by Node when imported, which could be a good replacement. It'll probably run when tests run instead but it's still going to run for most people.

knlsn• 2 months ago

are these fixed removed now?

Brybry• 2 months ago

Seems like it is fixed/removed: https://github.com/antvis/.github/commit/cb641113703e531ee43...

Some are still on npm but marked "deprecated":

https://www.npmjs.com/package/size-sensor/v/1.0.4?activeTab=...

As the article states, you can see in the package.json that the optionalDependencies references "@antv/setup": "github:antvis/G2#7cb42f57561c321ecb09b4552802ae0ac55b3a7a"

I'm pretty sure those commits have been removed from github:

https://github.com/antvis/G2/issues/7401#issuecomment-448480...

https://github.com/antvis/G2/issues/7394

kunalsin9h• 2 months ago

As similar to 1st wave of Shai Hulud, this also got it through opentionalDependency. intresting

somelamer5672• 2 months ago

In the fictional universe of William Gibson's Sprawl trilogy, it is legal and normal for defenders to go kinetic on cyberattackers. How long until it is simply easier for governments and big business in the countries victimised by these criminal groups, to find the path of least resistance and go after them personally?

thrownthatway11• 2 months ago

We can’t even prevent shop lifting.

somelamer5672• 2 months ago

Shoplifting isn't a national security matter.

sitkack4• 2 months ago

Compared to what?

abhisek• 2 months ago

Attackers are just having fun due to abysmal state of npm and some of the insecure design choices by GitHub and GitHub Actions. Every attack gives them credentials which in turn used to stage more attacks.

cyanydeez5• 2 months ago

perfect capitalism writ technology

LtWorf4• 2 months ago

What they do is already illegal. The problem is finding out who they are and where they live to go and arrest them.

thrownthatway11• 2 months ago

I’m not convinced.

My understanding is that the problem is more that calling in the heavy artillery for what amounts to an annoyance, and maybe some financial harm, is generally considered impolite, even among nations that have conflicting worldviews.

mycall• 2 months ago

When you have AI models finding vulnerabilities by themselves in a for-loop, it isn't long before there is no human to go kinetic on.

Outlook5813• 2 months ago

another day, another npm hack.

AgentME• 2 months ago

Another supply chain attack found and blocked in a day. Everyone regularly using npm to install new packages should be using npm's min-release-age setting to avoid package versions that are newer than a few days old to avoid most attacks in practice like this. You can set it to two days with `npm config set min-release-age=2` for example. https://cooldowns.dev/ has info about equivalent settings in other dependency managers like PyPI and Cargo.

sevenzero• 2 months ago

Or just use dependencies from 6 years ago and never update them like most companies i ever worked for.

halfcat• 2 months ago

Accidental true leadership

rubnogueira2• 2 months ago

aube (npm/yarn/pnpm drop-in alternative) now has a "jailBuilds" flag that restricts access to network/filesystem access.

https://aube.en.dev/package-manager/jailed-builds.html

But this feels like a cat/mouse game.

cyanydeez5• 2 months ago

dino was wired with security in mind, but you can see developers dont tend towards aecurity

rubnogueira2• 2 months ago

Because there is a time and effort cost to swap over to another framework/runtime even if it brings benefits, and security is always considered "good for now" unfortunately.

That is what made Bun popular, and tools like uv/pip, oxlint/eslint, orbstack/docker desktop, and the list goes on. Drop-in replacements where we get 10x with little effort.

epicide• 2 months ago

Because employers don't tend towards security. In fact, many actively punish somebody for "sandbagging" or simply taking too long if they even suggest a security concern.

esafak2• 2 months ago

What is dino?

no-name-here2• 2 months ago

aube (npm/yarn/pnpm drop-in alternative) now has a "jailBuilds" flag that restricts access to network/filesystem access.

1. It seems like the restrictions are only for lifecycle scripts, so wouldn't help if/when the package's actual code had malicious code inserted?

2. Package managers like pnpm seem to entirely block lifecycle scripts by default, so I guess this is an in-between solution.

Still, I guess it's a step in the right direction for those want or need to run lifecycle scripts specifically.

jdxcode• 2 months ago

1. the supply chain attacks I've seen are naive. They just leverage postinstall hooks. Malicious code also needs to be executed, not simply installed, so it's a lot less likely that an exploit would happen compared to postinstall since it can't just be buried in a transitive.

2. aube does the same. This is an extra level of protection if you've already whitelisted a package

CafeRacer• 2 months ago

i run all my stuff in vm's built with nix

not as easy as docker, but i have a few bash scripts that simplify things for me a lot

i hope that this protects me from the sweep attacks at least

aa-jv• 2 months ago

Node is the Visual Basic of our day, if Visual Basic had the ability to update itself from a thousand strangers, any minute of the day, without the user-developer having any clue what is going on behind the scenes unless they apply the very skills that would have precluded their use of Node/Visual Basic in the first place.

All that ease-of-development is being paid for by ease-of-rooting.

jgrahamc2• 2 months ago

And this is partly why my development machine is a Raspberry Pi that I can image any time by removing the SD card: https://blog.jgc.org/2026/04/raspberry-pi-as-isolated-ai-cod...

Shank• 2 months ago

I mean that's lovely, but you still store confidential data, I assume, like credentials on your development machine? This doesn't solve anything but the least important "reinstall the OS post-compromise" step.

jgrahamc2• 2 months ago

On that machine there's Claude's authentication for my account so I can run Claude on it, a public key so I can SSH to the box, and a private key for GitHub access.

Havoc2• 2 months ago

Pretty wary of the entire JS/nodejs ecosystem at this stage.

matheusmoreira7• 2 months ago

Same. At this point I just started using virtual machines for any project that pulls in packages from outside Linux distribution repositories.

michalsustr• 2 months ago

Given general software quality of the js ecosystem, the proliferation of supply chain attacks was just matter of time. I’m curious how other ecosystems will hold (eg Rust)

freakynit8• 2 months ago

And now, vibe-coding is just gonna take this to a whole another level.

tadfisher• 2 months ago

NPM is an easy target because every package has the capability of interacting with your development environment by default, via pre/post-install scripts. Cargo has something similar with build.rs scripts, as does Cabal (Haskell).

In JVM-land, thanks to binary distribution being the default, the number of packages you can usurp to achieve the same compromise is fairly small; essentially Maven and Gradle plugins. Which is why you should be extremely wary when, say, Sentry tells you to add them as a dependency by setting up their Gradle plugin. Not sure about sbt. Clojure source dependencies can provide "prep" scripts, which are not automatically run as part of a build, but still execute code on your machine.

There's a pattern here: some build tools incorporate dependency-provided code as part of the consumer project's build, and that is a juicy attack surface. Packages which include such code, or are recently updated to include it, should be treated with extra scrutiny.

cozzyd• 2 months ago

Yes... The only things I use from the JS ecosystem are {Claude,gemini}-cli which I fear will be compromised. Fortunately I run in them in their own user accounts with no e.g. ssh credentials, but I dead that's not enough especially for Gemini which probably has access to my entire Google account somehow.

mghackerlady6• 2 months ago

JS is a fine frontend language I guess, if you're willing to hand-roll your own code instead of using frameworks and junk. Whoever decided that JS deserves to run as a backend is an idiot who should not be trusted to evaluate languages anymore, lest they decide cobol is a good idea

nojs• 2 months ago

One solution I haven’t seen recommended much is to have a Claude instruction/skill that explicitly audits the diff of every upgrade, and force this manual audit as part of your upgrade workflow. This seems like it would work pretty reliably.

quantumleaper• 2 months ago

This is what many AI supply-chain security startups (like the one that posted the article) are already doing with all NPM packages, so save yourself the Claude tokens. All of these compromises were detected within minutes, but it takes some time (<1 hour) for NPM to unpublish all of the affected packages.

PAndreew• 2 months ago

Sorry for my ignorance, but then couldn't we build this into NPM itself? So before a package is publicly available it would be quaranteened and checked.

madamelic• 2 months ago

Super dumb question as someone who has been using some form of AI for dev since 2023:

How does having an AI audit external code help? Can they not be prompt injected to ignore a malicious change?

I guess I am sort of concerned that they are a pretty thin layer and even if you put "DO NOT ALLOW PROMPT INJECTION", it's a bit like saying "make no mistakes". There _is_ a priority between `system` and `user` level messages as I had recalled, so a specifically made tool that has its own system prompt should prevent injection while asking Claude CLI could still allow for prompt injection.

What are your thoughts and experience?

Yokohiii2• 2 months ago

There are prompt guard classifiers that can detect prompt injections, but they are not perfect (false positives, obfuscation) and should be only a part of the defense.

The concern is real and unsolved. I think security researchers have an advantage here because they still can fall back to manual audits if their automated analysis (or scores thereof) is off.

teddyh• 2 months ago

‘No way to prevent this’, Says Only Development Community Where This Regularly Happens

— <https://itnext.io/no-way-to-prevent-this-says-only-developme...>

anonym29• 2 months ago

"A well administered supply chain, being necessary to the freedom of an open internet, the right of the developers to keep and bear hundreds of uninspected transitive dependencies, shall not be infringed."

ajross• 2 months ago

The Node ecosystem happens to be more vulnerable for social and software design reasons, it's true. But people need to be aware that PyPI and Cargo et. al. are not in any fundamental way less vulnerable. This will happen there too.

zarzavat• 2 months ago

To expand on this, PyPI is slightly less vulnerable because Python users tend to install mega packages (such as numpy or django) and do not frequently interact with their package manager. There is also not a culture of using sub-dependencies.

Cargo is essentially the same as NPM though, it's only "safer" because it's less popular.

Although the situation on NPM is extremely uncomfortable, you're probably less likely to get hit if you take reasonable precautions than on PyPI, simply because NPM is getting scanned more often. Most of these attacks on NPM have been detected and pulled days before my min age kicks in. A sleeper attack on PyPI could be devastating.

zahlman6• 2 months ago

In fact, attacks like Shai-Hulud explicitly attempt to get into PyPI, and have succeeded to a lesser extent.

But aside from the package-size / -complexity issue pointed out in a sibling comment, PyPI also tries a fair bit to monitor for incoming malware (and there's a "report project as malware" button on each project page).

Also, there are no post-install scripts (of course, the code can detect when it's being run for the first time in the installed environment); and pre-install scripts are only included in sdists[0]. So you can easily[1] configure your installer such that you at least won't get pwned at install time, at the cost that some[2] packages can't be installed that way. And then you can go inspect, run a security scanner over, etc. whatever got installed; wheel installations just copy things to well-defined locations and generate simple wrapper scripts by strict rules.

[0]: I.e., when the project is "being built from source", which generally is only necessary when it includes non-Python code directly and the maintainer hasn't pre-built that code for your system.

[1]: Notwithstanding that, with pip, many actions that you'd expect not to get you pwned totally can. Such as, for example, explicitly telling it to download an sdist and not install it; as I discussed in https://zahlman.github.io/posts/python-packaging-3/ .

[2]: In practice, a pretty small fraction of what typical developers would actually care about, at least outside of specific niches. I'm told there are some niches where it's a big problem, but honestly they're lucky that this kind of build-install orchestration sort-of works at all.

fennecbutt• 2 months ago

Isn't this more like a "Macs don't have viruses" type scenario though?

pletnes• 2 months ago

I thought it was «windows has all the viruses» since there are a lot of npm packages and it’s used by a lot of people?

mschuster912• 2 months ago

Says Only Development Community Where This Regularly Happens

We've had such issues on other places as well... Shai-Hulud got into Maven [1] and PHP Composer [2], typosquatters got into Maven [3], and it's not new either [4].

No one is safe from skiddies, much less from nation state actors.

[1] https://thehackernews.com/2025/11/shai-hulud-v2-campaign-spr...

[2] https://semgrep.dev/blog/2026/malicious-intercom-php-package...

[3] https://www.esecurityplanet.com/threats/malicious-jackson-lo...

[4] https://socket.dev/blog/malicious-maven-package-exfiltrates-...

gred2• 2 months ago

Your example of security issues in Maven is... npm guys setting up processes to auto-publish infected npm packages into the Maven Central repository?

Wake me up when the daily npm security breach headlines are typosquatting stories, not RCE-on-build or RCE-on-upgrade.

jubilanti• 2 months ago

Yeah funny, but npm is not the only development community where this regularly happens.

The Onion article this joke refers to [1] is funny because there is a very clear and obvious reason why the U.S. has far more gun deaths per capita. This doesn't apply for npm.

[1] https://theonion.com/no-way-to-prevent-this-says-only-nation...

throwaway27448• 2 months ago

Oh?

Edit: please explain. What other community has this rate of attacks? It's possible they are just detected or publicized less, too. Please help me understand what you're referring to.

woodruffw• 2 months ago

The analogy in npm is dependency proliferation, along with what appears to be weaker community norms around security. To the extent that either or both of these are true, I think the “no way to prevent this” quip is essentially accurate.

dspillett• 2 months ago

npm is not the only development community where this regularly happens

That is like people defending IIS in the early days by pointing out that Apache occasionally had security problems too. Or, back to the gun control analogy people saying “gun control didn't stop Bondi Beach, did it?” or pointing out [incorrectly]⁴ that everywhere that has gun control has knife crime⁴ instead.

because there is a very clear and obvious reason why … . This doesn't apply for npm.

I disagree. There are a number of reasons that stack together, the four that spring to the top of my head being:

1. Numbers. There are a lot of potential targets you can exploit if you manage to get something into a ecosystem that large. This “being a big fat target” combined with being easy to exploit makes NPM a very juicy target, and encouraging people to use such a target without trying to implement countermeasures for this sort of attack is IMO reprehensible. Numbers isn't a problem in itself, like in the bad old days when IIS was a mess but Apache got (successfully) attacked far less, but they do exacerbate the security issue by multiplying the attack surface area.

1b. A lot of those using it are relatively untrained or just following recipes so do not know how to protect themselves, and may not even update after an attack like this and remain vulnerable for some further time. While this is not NPM's fault, being due to the popularity/commonality thing, it is something those in control of NPM should care about, if, as I believe is claimed, they care about their users⁰.

2. It is an environment where a ridiculous amount of dependencies, nested impressively deep, is practically encouraged, making audit very difficult even for those who try.

3. A number of good suggestions have been made that would mitigate, or at least vastly reduce, the risks. But action on these has, as far as we know, not happened. Sometimes for good reasons, or at least for reasons¹ rather than “just because”/“cost to implement”/“we don't wanna”, and sometimes, well, not. And no alternatives from within those running NPM are being suggested/worked-on, as far as we know² at least.

4. Those who would make most noise about any change, especially a breaking change that affects them in the smallest way, simply do not care about the risk the situation poses to the wider population.

While the gun control analogy might be a little stretched, I think it is relevant enough particularly because of points 3 & 4.

--------

[0] I refuse to use the word community here. This isn't a cosy little village where everyone knows your name and everyone looks out for everyone else.

[1] Them bringing significant breaking changes, or being too complex to implement piecemeal to give time for those breaks are dealt with or otherwise prepared for, for instance.

[2] If something was being looked into, I'd expect it to be announced³ as that would quieten criticisms like these, at least a little.

[3] Maybe not immediately, but this has been a known problem for so long that we are well past immediately.

[4] When it isn't the case that the US doesn't have knife crime, it just doesn't get reported because the gun issues are worse. Like car travel killing more in total then flights, but you don't hear about every car crash. The UK is often given as an example in these comparisons, but if you look at the stats our knife crime rates are lower than the US's - it isn't that other countries have knife problems instead, the US has worse knife problems as well as the guns problem.

ErroneousBosh4• 2 months ago

Yeah funny, but npm is not the only development community where this regularly happens.

What are the other ones? Does this happen with the same sort of frequency?

OhMeadhbh5• 2 months ago

I initially read this to mean NPM has a pro-concealed-carry policy, which I don't think it does and I don't think is what you meant.

But... Node's culture does not reward "rational" policies with respect to dependency management in the same way that the US does not reward "rational" policies with respect to gun control *. But US gun control policy is a reflection of the "will of the electorate" -- i.e. there are a lot of Americans who want (or need) to own firearms. In the same way, NPM reflects the culture of high-speed, sili-valley web-devs.

I mention both not to criticize, but to comment it's not the tool that's at fault here, but the users who demanded it evolve the way it did. We moved fast. We broke things. And some of the things that remained broken were sociological: It's easy enough to add PGP/GPG signatures on packages, but whom do you trust? What is the meaning of a signature? Does it mean the signer warrants the package/version is free from defects?

NPM is working as designed. Users wanted the software construction equivalent of a loaded revolver. But we got something that was a bit more like a nuclear weapon with a large blast radius. At least the revolver user would more-likely only shoot their own feet six times (or twelve if they reload.)

[*] I'm trying very hard not to start a flame-war about gun control, I only mean to point out dependency management in node can be as contentious in it's domain as gun control policy is in the domain of US politics. Note that I am not making a pro or con argument about gun control, but only pointing out the issue exists. The word "rational" is intentionally chosen to reflect the fact that people's opinions on gun control and package management are often based on personal, often emotional beliefs (which should not be dismissed.)*

ch4s3• 2 months ago

NPM by virtue of its popularity and the vagaries of the ecosystem is always going to be a prime target for attackers, and people (maintainers) will always be a weak point.

freedomben2• 2 months ago

I agree generally, but I also think it's important to point out that in the NPM ecosystem it is culturally acceptable and even encouraged to install even trivial dependencies to avoid reinventing the wheel. Philosophically I completely agree with this, though practically we see the result and it is not good. The left pad debacle should have been a huge wake up call, but not really much seems to have changed after that.

As long as developers in the ecosystem are cavalier about installing huge chains of dependencies, NPM will be an attractive target for attackers.

Even though we wish it were not so, cultural problems seem to be the hardest technical problems to solve.

gabdpipi3• 2 months ago

Yeah I was thinking the difference between open source and enterprise to mitigate this is a simple hardware security module right?

If the attackers spearfish folks who hold “keys to the castle” and everything is digital it’s game over no matter what ecosystem.

Those things should be locked down by “something you have” because that’s much more difficult.

mghackerlady6• 2 months ago

Language exclusive package managers like this are nightmares for security, but npm simply does things so poorly I feel like they wanted something insecure.

fmbb• 2 months ago

What about language exclusivity makes a package manager a security nightmare?

tialaramex2• 2 months ago

The "No way to prevent this" analogies seem to me to work better for Memory Safety because, as with Gun Safety, the simple fact is that everybody knows how to solve the problem, but one group insists it's impossible.

There is crowing from the "Actually copy-paste is better" people when this happens, but when it's their turn they just jam their fingers in their ears. The memory safety and gun safety problems are the actual problem. Shai-Hulud would ruin your day if it got into the Odin release you used to build your software, or it was copy-pasted into your "vendor everything" C++ project, the choice not to have automation doesn't mean you fixed the problem.

nonethewiser• 2 months ago

The "No way to prevent this" analogies seem to me to work better for Memory Safety because, as with Gun Safety, the simple fact is that everybody knows how to solve the problem, but one group insists it's impossible.

I'm not following. Whats the 2nd Amendment equivalent for memory safety? The amount of C/C++ in production or something?

cuuupid• 2 months ago

I'll disagree because the primary issues with gun control in the US are:

[1] Guns are a core part of culture for much of America, very deeply so outside coastal cities. Most of the left wing in the US lives in coastal cities and either grew up there or immigrated very recently and does not leave, so this is an alien concept to them, but even in very blue cities like D.C. you would be shocked how many liberal democrats have armories. It is literally amendment #2!

[2] They are already widely distributed and it would be a logistical impossibility to actually enforce gun control.

This is directly analogous to NPM where:

[1] The package registry working the way it does and people quickly installing packages without thinking much is deeply part of JS culture. It doesn't help that JS caters very heavily to as wide of a market as possible, of which the majority is going to be entry level/junior to associate engineers for whomst script kiddying or letting AI install whatever is essentially a way of life. As evidence, this type of thing is not really a problem with derivatives like Bun, especially in mature organizations where it's easy to enforce a minimum 72 hour wait time between publish and installation of a package.

[2] Packages are already widely distributed and part of dependency stacks (e.g. the infamous leftpad) where it is a logistical impossibility to change how things work.

I also view startups and companies like Vercel as essentially the NRA here, Next.js has taken over huge swathes of the ecosystem and highly encourages dependency-maxxing.

Another direct analogy: proponents of gun control say they are unnecessary for self defense (esp. because law enforcement is good now), too heavy duty to begin with, and fundamentally dangerous.

Similarly I would criticize dependency-maxxing as unnecessary for capability (esp. because AI is good now), too heavy duty to begin with, and fundamentally dangerous.

ErroneousBosh4• 2 months ago

the simple fact is that everybody knows how to solve the problem

Don't make braindead My First C Program mistakes?

b0rtb0rt• 2 months ago

after running the original version of this into the ground we can run this one into the ground too

kixxauth2• 2 months ago

Vendor your dependencies, clone or port them where needed, and freeze them. Most good packages these days do not have a deep dependency tree, and we should stop using the ones that do.

I spent a week with claude and codex re-implementing several packages which had dependency trees deeper than I would like.

Most of these packages are trivial to clone.

"But now you're not getting the upstream fixes" they will say.

"So what?" I reply

no-name-here2• 2 months ago

Wouldn't just having devs pin/not upgrade packages accomplish about as much, have the added benefit that if a package is discovered malicious it would be removed from npm but if already vendored you’d still have the vulnerability on your vendored copy, and pinning versions seems like it would be more likely for devs to do than vendoring?

cj• 2 months ago

Pinning the version also avoids the risk of accidentally introducing new vulnerabilities while reimplementing the package yourself.

erikerikson4• 2 months ago

Not to support the GPs choices (they are not mine) but pinned dependencies can get grumpy over time with endless LTS migrations.

kixxauth2• 2 months ago

Yeah, pinning dependencies is very similar to vendoring or cloning them. By cloning, you get to know the code better and how it is structured, plus you cherry pick only the features you want.

But, like you said, you are at risk of introducing new vulnerabilities.

I'd just prefer making that bet on myself than someone I don't know

827a• 2 months ago

I can't wait for npm/github to do literally anything at all to mitigate these attacks. Literally anything. Have we considered a basic WAF-style block on some postinstall script strings? LLM-assisted code scanning on publish? Is there anyone home? No I suspect not.

pier25• 2 months ago

Third parties can detect compromised packages. It’s ridiculous Microsoft doesn’t.

lyu072823• 2 months ago

They can and do indeed detect those attacks, it's just from Microsoft's POV a feature of Microsoft Defender (on Windows and Cloud) they sell:

https://www.microsoft.com/en-us/security/blog/2025/12/09/sha...

https://azure.microsoft.com/en-us/pricing/details/defender-f...

So this is presumably why they will never address this in npm itself.

mannanj• 2 months ago

Why would a corporate company actually demonstrate responsibility and ethicality in its use of the open source commons from which it extracts every last penny and dollar?

Edit: a more suitable strategy is to do the minimal necessary actions for appearance purposes only, as its how to focus and optimize on its interest for revenue for its shareholders.

dawnerd• 2 months ago

They will once they figure out how to charge for it (which GitHub is trying according to the security scanning banner they keep showing me).

WorldMaker5• 2 months ago

It still seems wild that npm hasn't gone allowlist-only for pre- and post-install scripts like every other JS package manager (yarn, pnpm, Deno, Bun). Obviously it would be a breaking change that might wreck some developers' day for a little while until that allowlist is built, but it would go a long way to eliminate some of the biggest vectors for these attacks.

zahlman6• 2 months ago

... Deno and Bun manage packages? I thought they were just runtimes.

morpheos137• 2 months ago

it seems obvious to me the ability to push code to public repositories shluld be tied to real human identity.

wang_li• 2 months ago

Using code from these repositories should be considered the same as licking toilet seats at highway rest stops. There’s something wrong with you if you do it.

gherkinnn2• 2 months ago

In regards to the whole ecosystem: TC39 should take a look into adding a better standard library to JS itself, which would reduce the amount of one-liner packages.

I concur, the best part of working with Deno way back was its standard library [0] and overall complete dev environment. It is just so damn obvious that a runtime comes with an integrated test runner and assertion library.

0 - https://docs.deno.com/runtime/reference/std/

tln3• 2 months ago

I'm not sure any of the packages here would be part of a "better standard library".

Do any language standard libraries have a "3 hours ago" formatter? Thats what timeago.js does

Maybe slice.js, which just does python-style indexing with negative numbers. TC39 already made array.at() and array.slice() handle negative numbers.

WorldMaker5• 2 months ago

Do any language standard libraries have a "3 hours ago" formatter? Thats what timeago.js does

There's also a platform feature for that now: Intl.RelativeTimeFormat: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

It asks you to do the basic time math to determine your granularity so there's still a role for a library, but also that time math gets easier with Temporal: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

(Specifically `Temporal.Now.instant().since(somePastInstant)` returns a Temporal.Duration that you can relatively easily determine the highest granularity you want and pass that to an Intl.RelativeTimeFormat instance. Also Intl.DurationFormat which is what a Temporal.Duration's `toLocaleString()` uses may also be good enough in many "x hours ago" type situations, though it is over-precise for them.)

ireadmevs• 2 months ago

Worth noting that nowadays nodejs std lib keeps growing and includes the aforementioned assertion and testing support.

https://nodejs.org/api/

WorldMaker5• 2 months ago

To be fair, Node has `node:test` [0] and `node:assert/strict` [1] modules out of the box for several LTS versions now. `node --test` can easily replace Mocha and `node:assert/strict` is fine, but `chai` is still sometimes nicer (include ergonomics like `expect`). (Deno's @std includes an `expect` style assertion library.)

Of course, the trouble is that there are so many test runners in the Node ecosystem and many of them cannot be as easily replaced as Mocha, so the shift to the out-of-the-box test harness and assertion library will of course be painfully slow. People like the over-complicated nature of both Jest and Vitest for all sorts of reasons. Major companies thought Karma was a good idea. (I still don't understand why more developers didn't cringe at "Yo dog, I heard you like V8 for your unit tests, so we're gonna spin up a second, different copy of V8 from your existing V8 environment.")

[0] https://nodejs.org/api/test.html

[1] https://nodejs.org/api/assert.html#strict-assertion-mode

gherkinnn2• 2 months ago

Much came after Deno added them. I don't know what will happen to Deno, but I am glad they showed the Node world than life can be a little more pleasant

btown3• 2 months ago

At a certain point, is it better to just turn off Dependabot and freeze all NPM packages (minor/patch version and all), rather than continuously update? Particularly for frontend packages, meaningful security fixes seem less likely than supply chain attacks these days.

It's a sad state of affairs, for sure - but is there a reason we can't just switch our frontends to static BOMs, and trust that NPM at least gets their "you can't republish to an old version" bare-minimum constraint right?

peterldowns• 2 months ago

Yes. This is partially why other ecosystems don’t see as many supply chain attacks.

zahlman6• 2 months ago

and trust that NPM at least gets their "you can't republish to an old version" bare-minimum constraint right?

... Does NPM not create full lockfiles, with hashes and pinned transitive dependencies and everything?

btown3• 2 months ago

Yes, and the problem here is that most projects have automated systems that automatically update those lockfiles on every upstream release of a library, under an assumption that minor releases are either security patches or bugfixes that would immediately be useful to the consuming project.

IMO this is built on a pre-ShaiHulud, pre-AI set of assumptions, and should be evaluated from first principles with today's security situation.

esafak2• 2 months ago

https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-...

Sohcahtoa822• 2 months ago

At a certain point, is it better to just turn off Dependabot and freeze all NPM packages (minor/patch version and all), rather than continuously update?

But then the compliance team gets annoyed because some CVE with a CVSS score of 3.1 that has a patch available sits unfixed.

btown3• 2 months ago

I wonder if the only thing that will solve this is an insurer or regulator saying that: "A system that automatically pulls updates for dependencies without human review, where said updates are not protected by multi-factor authentication by their respective maintainers, shall not be considered secure."

That would wake NPM up at least to the notion that it's absolutely reasonable to require OSS maintainers to press a button on their phones when releases go out, and that's a good thing not a bad thing.

lovich• 2 months ago

The core problem is companies skimping on maintenance.

They don’t want to pay engineers to do the analysis manually, and they don’t want to pay for someone to figure out a better automated system.

Would anyone be surprised at their car having problems if they cheaped out on oil changes?

tedd4u• 2 months ago

Enforce a “seasoning” period, for example don’t let any pull pull versions newer that 30 days. Perhaps with an exception for versions that address known CVEs.

mrgoldenbrown• 2 months ago

I want to go all in on zed now that it's 1.0 but it's security model is all or nothing AFAIK - either I allow it to download and install unknown to me NPM packages whenever it wants with no notice to me, or I turn off all LSP functionality. And then I keep seeing news like this.

troad6• 2 months ago

I'm very glad I never bought into fullstack JS/TS.

My JS is frontend only, served as a compiled bundle off a server that doesn't even have a JS runtime of its own. Whatever random vulnerabilities the frontend contains are limited in blast radius to the user's own browser, and since all frontends should be untrusted anyway, there is no real security risk to the server or backend. No reason to update more than a few times a year, if that.

Combine with obvious basic security practices like pnpm cooldowns + no build scripts. When you upgrade a few times a year, and frontend vulns don't matter, there's really no limit to the cooldown you can set. 60 days, why not.

austin-cheney• 2 months ago

If you serve any third party logic, such as advertisements, your code is just as potentially compromised.

troad6• 2 months ago

Only the frontend, which is already untrusted. Any risk would be restricted to individual users who used the compromised frontend to communicate something sensitive, and while that's not great, it is significantly better than the backend being compromised. A very significant reduction in blast radius.

Funnily enough, I don't actually think I do serve third party JS, though. Don't serve ads, don't use external telemetry, don't use JS CDNs. I don't think you have to go quite as far as I do, though - I imagine if your ads are Google AdSense or something, you're probably going to be fine.

ZiiS• 2 months ago

It is your development machine's AWS keys they want. The server's keys should be too finly scooped anyway.

troad6• 2 months ago

Not likely to be a major risk if you update every few months, to some major version that's already over a month old.

wavemode• 2 months ago

I would imagine it's the opposite. Most dev's machines can't query the prod database, for example, whereas a prod server can.

erikerikson4• 2 months ago

compiled bundle

Where does that compilation happen again? Not on the front end and it happens exactly where the exploits have been targeting (dev and build boxes).

troad6• 2 months ago

Hardly a factor when you're (deliberately) months behind.

mghackerlady6• 2 months ago

Also, I feel like a lot of fullstack JS is written by people who started with frontend JS and don't have nearly enough backend experience

troad6• 2 months ago

I came from systems programming, so I think half of what happens in JS is nuts.

sph• 2 months ago

JS programmers today are the PHP programmers of 25 years ago. Remember how many SQL injection bugs there was at the time? Little Bobby Tables remembers.

The standards haven't changed; for the vast majority of JS programmers, this is their first programming language and they have no solid foundation of architecture and security.

So what you get are these overly enthusiastic newbies that want to share their latest achievement with the world (say, a function to left pad a string), and why not include a fancy post-install script with emojis that makes adoption even simpler for other complete noobs? And this is the result.

KolmogorovComp• 2 months ago

What would be the required budget to host an alternative registry? I'm surprised any GAFAM still hasn't stepped-in and started building their alternative, at least for NPM to up its game in order not to become completely irrelevant.

ruined• 2 months ago

at amazon, they maintain a private internal registry of packages with approved licenses and audits. this has been in place for several years. i assume other big corps enforce similar policies

philipwhiuk• 2 months ago

If your company not running an internal proxy at minimum you're stupid - you have no audit function for what libraries are being pulled.

a1o2• 2 months ago

Do you know if they are using any product like JFrog for this or rolling their own?

perdomon• 2 months ago

writing your own code is only harbor in this storm. vanilla js cries out into the night sky. will you answer?

pmdr• 2 months ago

That and vendored HTMX. Nobuild. JS on the backend looks more and more like a very bad idea.

dmitrygr• 2 months ago

Libc still unaffected. Write native code. Your users will thank you

timfsu• 2 months ago

PSA - you can run something like `npm install -g npm@11.10.0; npm config set min-release-age=3` to update to a version of npm that supports the min-release-age configuration

freakynit8• 2 months ago

Collected all the attacks that happened in the npm ecosystem in past 1 year here:

https://npm-supply-chain-attacks-25-26.pagey.site/

kjok• 2 months ago

Please also collect responses from people, you'd find a pattern: a new attack is launched, people make noise, and later go back to installing packages the same way. Enterprises already use private registries to combat such attacks, vulnerable folks include individual devs and small teams.

freakynit8• 2 months ago

Want to.. but I'll need to first integrate social-media and forum scanning in my tool. Haven't done that yet.

But, it's a good feature to have.

Thanks.. gonna integrate now :)

HDBaseT3• 2 months ago

Did Claude generate this site?

The scroll seems to jump all over the place on my device.

freakynit8• 2 months ago

yep... fixed it in new version. Thanks for mentioning.

tln3• 2 months ago

pre- and post- install scripts should just be abolished. It should require a special dispensation from npm to even publish one.

Yes, I choose to use pnpm but opt-in safety isn't going to get the developer community to herd immunity.

nepthar• 2 months ago

“No way to prevent this” says only package manager where this regularly happens.

bakugo• 2 months ago

Is there anything about npm that makes it particularly susceptible to these attacks, other than the fact that it's the most popular package manager of all?

freakynit8• 2 months ago

Yep.

1. Every day there's a new package.

2. Then five more packages appear so you don't have to write that one terrifying line of JavaScript yourself.

3. Then someone writes a wrapper around those five packages.

4. Then someone writes a "modern, lightweight, zero-config" wrapper around the wrapper.

5. Then a framework adopts it, a build tool requires it, and suddenly your todo app has a dependency graph that looks like international diplomacy.

6. Out of 100 devs building the same product, there are now 300 different dependency combinations, all somehow involving 'left-pad' spiritually if not literally.

7. Half the packages are maintained by one person, unpaid, at 2 a.m., after getting yelled at in GitHub issues.

8. The other half were abandoned three years ago but still have 40 million weekly downloads because removing them would break civilization.

9. Pinning dependencies sounds nice until the ecosystem tells you, "sorry, this package only works with Node 22, this plugin needs Node 18, and this transitive dependency has discovered ESM enlightenment."

10. So everyone lives on the bleeding edge, except nobody agrees where the edge is, and the bleeding part is very real.

So yeah, npm is not uniquely cursed because JavaScript devs are worse. It's cursed because it turned code reuse into a lifestyle, dependency trees into rainforests, and 'npm install' into an act of faith.

kommunicate• 2 months ago

npm can execute code after install and most package managers don't do that

Sohcahtoa822• 2 months ago

It's the general ecosystem.

There's not a word in the English language that really expresses how absolutely stupid the npm ecosystem is and the developers that perpetuate it by importing a package rather than writing 5 lines of code.

staticassertion4• 2 months ago

No. NPM's not particularly bad at all tbh.

downrightmike• 2 months ago

OWNED BY MICROSOFT

smsm42• 2 months ago

This had been going on for years. I'd expect there would be some kind of solution for now? Like banning scripts and only allowing them to be executed at the explicit user request, for example (not a guarantee but at least a barrier) or somehow restricting them from accessing stuff that does not belong to packaging system. I mean, we have millions of people in the ecosystem, and we keep having this problem for years. Maybe we should ask Claude Code how to fix it (sad laugh)?

staticassertion4• 2 months ago

The solution is to do exactly what you suggest - separate access. In CI this is a matter of having your "build/test" jobs happen separately from your "deploy/publish" jobs.

The trickier part is dev environments, but ideally you take a similar approach. The place that devs do `npm install` should be isolated from, say, your browser / ssh keys etc.

Package manager support would be an amazing win here since you'd have an easier time managing the isolation but you can do this today.

freakynit8• 2 months ago

npm, the ecosystem: https://npm-the-ecosystem.pagey.site/

tomxor2• 2 months ago

At this point lifecycle script should be disabled by default in NPM.

It's a convenience feature that provides built-in Arbitrary Code Execution (even for transient dependencies), and every one of these widespread NPM worm style attacks has propagated through it, because of the default setting. Also enabling it for one command shouldn't automatically permit all transient dependencies to run lifecycle scripts, it should be required to explicitly mark each dependency to limit it to where it's absolutely necessary.

The vast majority of NPM packages do not depend on these scripts, and you should disable them globally if you haven't already.

hirako2000• 2 months ago

Or simply use pnpm.

tomxor2• 2 months ago

That's helpful to prevent individual secret harvesting, however it does not protect you from potential silent downstream effects in packages. i.e. inclusion of malicious code in libraries you depend on, this could be as simple as inserting a cryptominer, or as severe as data exfil in a front end package.

This default can affect all consumers of NPM packages, regardless of whether you use yarn, pnpm or npm itself, because most package maintainers use NPM. This is why it's NPM's responsibility to change this default in order to prevent spread of malware in packages.

bakkoting2• 2 months ago

There's an RFC for this: https://github.com/npm/rfcs/pull/868

josephg• 2 months ago

Yeah. Or they should run in a sandbox. I would have no problem with a post install script which ran arbitrary commands in the context of the installed package itself. But arbitrary scripts + user level permissions is a recipe for disaster.

That said, packages could still just run whatever junk they want when they first get imported in a program.

codedokode2• 2 months ago

If you are using NPM for business, you should be paying for a repository which was checked by antivirus company and not rely on free repository supported by unpaid volunteers.

urbandw311er• 2 months ago

This list is incomplete - at least one other package (nx-console VS code extension; 2.2M downloads) was compromised yesterday with this worm: if suitably qualified/connected people are reading this, it could be worth following that dependency chain too in case there are more. See here:

https://github.com/nrwl/nx-console/security/advisories/GHSA-...

PS: I posted on HN to try and alert people right after it was compromised but sadly got almost no upvotes :-(

HALtheWise• 2 months ago

I wonder if npm could run a program where package uploads are automatically delayed for ~10min while they get distributed to an ecosystem of third-party code auditing companies for automatic checks. You could have a public leaderboard of which auditors detect problems fastest and most reliably, or even monetary compensation.

Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

Related Stories