Hacker News new | past | comments | ask | show | jobs | submit
thinkingemoji | on: Keyv and friends compromised in active Shai-Hulud supply chain attack
No way to prevent this says only package manager where this regularly happens
insanitybit | parent | next
This is the most boring comment posted on every one of these. NPM is by no means the worst offender here and offers a ton of solutions to this, lots of package managers are behind it or equivalent.

NPM gets targeted a lot because it's popular. That's it.

acdha | root | parent | next
It’s correct that NPM is not unique but it is the worst for cultural reasons: no other ecosystem started with such a limited language, which lead to the culture of publishing tons of small packages working around things which everything else had builtin. A Python project which has a hundred dependencies is considered quite large but the median React project had north of 30 thousand for years and years.
insanitybit | root | parent
I think that's barely meaningful. Which of the compromised packages would have been part of any reasonable stdlib?
loading story #49172802
altcognito | root | parent | next
> NPM is by no means the worst offender here

Ok, I can agree it is a boring comment, but who is worse?

NPM gets targeted both because it is popular and because there is a wider attack surface (lots of little packages promoted by a huge variety of users) I have a high schooler who published work a couple weeks ago. This is good, but it comes with downsides. Maybe a couple more speed bumps or classifiers would be helpful. Maybe a consolidation of under maintained projects and deprecation is in order.

insanitybit | root | parent
Arguably crates.io is worse. NPM has cooldowns and has for a while, it has had Trusted Publishing for longer, it has human-approved releases that separate CI/CD from actual publishing. Ruby is probably worse in every way.
loading story #49172243
walrus01 | root | parent | next
Other than what happened with 'xz', which was upstream of it getting packaged, how many times has this happened in the debian packages system? Also very popular.
insanitybit | root | parent
I don't consider these comparable in any way that's worthwhile. The scale and goals are completely different.
loading story #49171336
lurkerforawhile | root | parent | next
left-pad was over a decade ago. it's a problem with the registry itself, more than just the package manager.
loading story #49174152
rvz | root | parent
No other package manager is worse than NPM. Outside of its 'popularity', there are several fundamental reasons why this continues to happen to NPM:

- Imported packages are not pinned by default.

- Typescript / Javascript's lack of a standard library encourages the developer to import more packages into their codebase to address the short-comings which increases the risk of importing a bad package.

- Post install scripts execute external code by default upon downloading dependencies.

All of this comes by default in the ecosystem and we continue to see more shai-hulud worms all easily targeting NPM. Not even signed packages are enforced by default either.

fr3dx | root | parent | next
> Imported packages are not pinned by default

What do you mean? The lockfile of all package managers is there for pinning the exact versions. For yarn and pnpm, installs on CI run automatically from lockfile only, for npm I think you still need to run `npm ci` instead of `npm install`. But this guarantees that no new versions get pulled automatically in by CI.

> Typescript / Javascript's lack of a standard library

That's true, but it's not an issue of the package manager / registry

> Post install scripts execute external code by default upon downloading dependencies.

They are disabled by default in all package managers now, the user needs to manually allow them

madeofpalk | root | parent | next
Two out of three of your points - the first and last - are just incorrect.
insanitybit | root | parent
Ruby is worse. crates.io is arguably worse.
jesse_dot_id | parent
echo "min-release-age=5" >> ~/.npmrc