Programming

26958 readers

1270 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Follow the programming.dev instance rules
Keep content related to programming in some way
If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities !webdev@programming.dev

founded 2 years ago

MODERATORS

snowe@programming.dev

Ategon@programming.dev

UlrikHD@programming.dev

bugsmith@programming.dev

Spyro@programming.dev

186

‘No Way To Prevent This,’ Says Only Package Manager Where This Regularly Happens (kevinpatel.xyz)

submitted 19 hours ago by HaraldvonBlauzahn@feddit.org to c/programming@programming.dev

39 comments fedilink hide all child comments

SAN FRANCISCO, CA - In the wake of a devastating supply chain attack in the npm registry that left millions of enterprise applications compromised and billions of user records exposed, developers across the JavaScript ecosystem expressed deep sorrow today, lamenting that such a crisis was completely unavoidable.

“It’s a shame, but what can you do? This is just the price of building modern web apps,” said Senior Frontend Engineer Mark Vance, echoing the sentiments of a community that completely relies on a 40-level-deep nested tree of unvetted packages maintained by pseudonymous strangers to capitalize a single string. “There’s absolutely no way to foresee or prevent someone from taking over a long-abandoned utility package and injecting a crypto-miner into every production build in the world. It’s just an act of nature.”

you are viewing a single comment's thread
view the rest of the comments

[–] Korkki@lemmy.ml 8 points 18 hours ago (3 children)

Didn't pypi have the worm too recently?

Also I have no idea why npm is worse offender than most? Is it that the install scripts can you execute any code they want?

[–] iglou@programming.dev 2 points 7 hours ago* (last edited 7 hours ago)

Because there is a much larger number of small libraries that end up in every project somewhere down the tree. So: higher count of opportunities.

Because JS is much more popular than any other language and is used in virtually every web project. So: higher impact when successfully executing a supply chain attack. (this is the same reason why Windows has more viruses than linux or osx: not because linux and osx are intrinsically more secure - even if they are, that's never going to be the main factor - but because there are a lot more tech illiterate users with Windows than the others)

NPM isn't particularly less secure, it's just more attractive to exploit.

[–] grue@lemmy.world 14 points 13 hours ago

Also I have no idea why npm is worse offender than most?

I think it's because JavaScript devs have a more promiscuous culture of code reuse than most. In what other language community would something like left-pad justify being its own package?

[–] moonpiedumplings@programming.dev 7 points 17 hours ago

Yes. Install scripts. But also pypi started enforcing 2fa for package pushes, which helps a lot.