Re:NPM Package Hijacking From the Hijacker's Perspective
by ENTP on Friday March 25, 2016 @04:24PM
(#11362419)
The post install script can be like any other script the user can run. There's no sandboxing so it can access anything the running user can access. So essentially, yes, it could infect any other module in there. I believe it could even run an "npm publish", which is pretty scary.
[ Parent
| on HN ]
Re:NPM Package Hijacking From the Hijacker's Perspective
by gry on Friday March 25, 2016 @09:24PM
(#11363952)
Even worse, `scp` the `~/.ssh/id_rsa` private key and known hosts file. The attack vector went tenfold.
Re:NPM Package Hijacking From the Hijacker's Perspective
by dineshp2 on Saturday March 26, 2016 @02:42AM
(#11364722)
The recent NPM situation was a real eye opener for me. I never gave much thought to the attack vectors involoving package managers.
> The post install script can be like any other script the user can run. There's no sandboxing so it can access anything the running user can access.
Wow. This just seems wrong that the script has such far reaching privileges.
Re:NPM Package Hijacking From the Hijacker's Perspective
by nmjohn on Saturday March 26, 2016 @03:15AM
(#11364765)
Considering node.js is able to spawn subshells and execute whatever code it wants when running, install scripts pose no additional threat to just running the javascript.
Re:NPM Package Hijacking From the Hijacker's Perspective
by rdancer on Saturday March 26, 2016 @09:06AM
(#11365513)
The changes a package install makes ought to be limited to the source files within its subdirectory (and perhaps some precompiled binaries). I don't quite expect it to be installing rootkits, and the principle of least privilege dictates that it should not be allowed to.
Once the package is installed, it is already too late for a code review, or any mitigation. A well-written worm will never be detected.
It is unexpectedly bad design (or, in case of the JavaScript community, an expectedly bad design).