News for hackers. Stuff that matters.

A comment on Malicious code in the purescript NPM installer. Parent comment

Re:Malicious code in the purescript NPM installer by allover on Monday July 29, 2019 @02:30PM (#20557756)
1) As I said, it was not just JS in this situation at the time, it also applied to other major registries like PyPi. So your point does not reinforce the original attack on JS developers. Congrats to Maven for getting this right.

2) Namespaces were added later. It wasn't "a decision to make them optional". Also check out for the discussion here as to how namespaces don't solve this issue, this point is largely moot.

3) I'm not the person blanket attacking a community. Or making unlikely assertions that "nobody" in the Java world installs direct from the internet.

4) Detail the exploit, otherwise this is FUD.

[ Parent | on HN ]
Re:Malicious code in the purescript NPM installer by kkapelon on Monday July 29, 2019 @06:07PM (#20559975)
4) You work for a Linux distribution. You have several global npm modules already installed that are safe and secure. You download source code of a killer app in order to package it. You check the source code itself and it is safe. However you didn't realize that there was a local node_modules directory in the git repo that contains package foo-1.2.3 with replaced code that does bad things. That package overrides your global one. You ship a compromised app.

The above scenario is impossible with maven, because there is no concept of local modules. Only the "global" ones will be used when you package an app. So if you check just the source code and it is safe then everything is fine.

[ Parent | on HN ]
Re:Malicious code in the purescript NPM installer by akamaozu on Tuesday July 30, 2019 @01:44AM (#20562383)
Sounds like your argument boils down to "check the source carefully", not "local modules are evil".

If the source was checked carefully, you'd notice a checked-in node_modules dir.

If you didn't check the source properly, you could install a module that seems like it'ss using a known package, but really is using its own malicious version of the global package.

[ Parent | on HN ]