News for hackers. Stuff that matters.

A comment on Active NPM supply chain attack: Tinycolor and 40 Packages Compromised. Parent comment

Re:Active NPM supply chain attack: Tinycolor and 40 Packages... by singulasar on Tuesday September 16, 2025 @08:06AM (#45261116)
I'm so sick of people saying this. If you use js for any non-tiny project, you'll have a bunch of packages. Due to how modules work in js, you'll have many, many sub dependencies.

Nobody has time to review every package they'll use, especially when not all sub dependencies have fully pinned versions.

If you have time to review every package, every time it updates, you might as well just write it yourself.

Yes, this is a problem, no reviewing every dependency is not the damn solution

[ Parent | on HN ]
Re:Active NPM supply chain attack: Tinycolor and 40 Packages... by efortis on Tuesday September 16, 2025 @12:52PM (#45264750)
Show them this Ken Thompson paper of 1984: "Reflections on Trusting Trust"

https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

And then hardware compromises…

I don't mean install anything. I mean, it's not a problem particular to the JS ecosystem.

[ Parent | on HN ]
Re:Active NPM supply chain attack: Tinycolor and 40 Packages... by lrvick on Tuesday September 16, 2025 @09:41PM (#45270574)
I full source bootstrapped a Linux distro from hex0 all the way to nodejs binaries just to deal with trusting trust risks.

"just give up" is not a valid strategy.

https://codeberg.org/stagex/stagex

[ Parent | on HN ]
Re:Active NPM supply chain attack: Tinycolor and 40 Packages... by efortis on Tuesday September 16, 2025 @11:24PM (#45271271)
where can I follow you? blog, x?
[ Parent | on HN ]
Re:Active NPM supply chain attack: Tinycolor and 40 Packages... by lrvick on Wednesday September 17, 2025 @01:45PM (#45279005)
https://lance.dev has my mastodon etc. My friends and I also run the #! community, https://hashbang.sh #!:matrix.org
[ Parent | on HN ]
Re:Active NPM supply chain attack: Tinycolor and 40 Packages... by lrvick on Tuesday September 16, 2025 @09:39PM (#45270558)
I have built and shipped production web applications for many large orgs with millions of users. Used 1-2 libs tops that i reviewed myself.

Also now as someone that runs a security consulting firm, we absolutely have clients that review 100% of dependencies even when it is expensive.

Both are valid options.

Normalized negligence is still negligence.

[ Parent | on HN ]