-2

When we clone git projects to use as is or when we install free npm packages provided by third party sources, is there any security risk? how trustworthy such packages are for production environment?

4
  • 1
    Some examples of open-source software which contained malware at some time are Mint, Transmission, Handbrake.
    – Sjoerd
    Jan 31, 2018 at 11:19
  • 1
    Most of the internet runs on open-source packages and they are highly trusted. There are some isolated incidents but mostly low-profile. If you ask specifically for git repos, these are very rarely with backdoors, especially if from reputable vendors. Regarding NPM, it's big and new repo with pretty much a lot of mess, so caution should be taken when dealing with these. If you mean if they are secure as if it's secure source code, it depends on the vendor. Lot's of open packages has commercial backing and are widely used thus well debugged and often more secure than commercial equivalents.
    – Aria
    Jan 31, 2018 at 12:14
  • "is there any security risk?" I find it hard to think of anything that doesn't have some risk. Jan 31, 2018 at 17:15
  • @Aria Widely-used does not imply secure and well-debugged. Just look at openssl or ntpd.
    – forest
    Feb 1, 2018 at 3:06

2 Answers 2

2

Of course there is a risk.

Floss software doesn't eliminate malware, it just makes recognizing it possible. For a well-known big project, there will be some people looking at the code all the times, so that no single person can ever do anything bad. For smaller projects, you would need to check yourself if you want a guarantee that it is fine.

And, of course, bad sourcecode is not the only problem. Sourcecode can be not the one used to compile the binary version. Or, if you compile it yourself, there's even a (small) risk of bad compilers (while even the compiler source is completely fine - describing this goes to far here). And it doesn't have to be the author of the program, third parties can comprise the server too, or tamper with connection data etc.

2

Especially on npm there were known active attacks. The package cross-env was useful and used by many users, but the package crossenv would leak all your environment variables to another host.

Someone took this to the extreme by registering a lot of packages in a lot of systems, which could have resulted in the compromise of 17000 hosts.

Furthermore, someone showed that some NPM accounts used weak passwords, which could result in distribution of malicious code.

Not the answer you're looking for? Browse other questions tagged or ask your own question.