Questions tagged [package-manager]
A package manager is a tool that automates the installation, updating and removal of software.
51
questions
0
votes
1
answer
60
views
How is the npm package manager made robust security-wise, what are the keys they are using, and how do they use them?
I am specifically looking at the npm package metadata like from the lodash package, the relevant part which is this:
{
"shasum": "392617f69a947e40cec7848d85fcc3dd29d74bc5",
&...
- 618
2
votes
1
answer
115
views
Distinguish origin of password prompts
I am wondering how to distinguish (password) prompts that the OS issued from prompts that are delivered application-side. This question first occurred to me when considering Firefox master passwords, ...
- 21
0
votes
3
answers
103
views
Security and data protection reviews of npm packages
Does npm ensure that the packages are not spying on your data, saving it somewhere or is it the responsibility of the developer to ensure it? Can I confidently use the moderately well-known packages ...
1
vote
3
answers
170
views
Supply chain risks for OS packages
The risks of supply chain attacks on software libraries is well documented, however, I have not seen much on OS packages/dependencies. How important is it to both 1) pin OS dependencies (apt,rpm,etc.) ...
- 543
1
vote
0
answers
49
views
Does Firefox's addon/extension installer provide cryptographic authentication and integrity validation?
Does Firefox's built-in installer for addons/extensions validate its payload's authentication and integrity for all files it downloads before actually installing them?
I avoid in-app updates because, ...
- 998
1
vote
0
answers
363
views
Restrict node.js filesystem access
I have a Node.js app which has a lot of npm-dependencies, running on Linux (Centos) machine.
When Node starts, the script has access to the files outside its directory (as least by default), so ...
- 309
12
votes
3
answers
4k
views
How to vet third-party developer packages
Looking to create a form where developers can submit requests for packages to be installed. We want to create a list of questions that can help us determine whether or not a package is safe. What are ...
- 123
0
votes
0
answers
242
views
How do you lock down PyPI access?
Another question (Is it possible to block non-PyPI requests during pip install?) asked about locking down non-PyPI pip installs for security reasons. This doesn't deal with the problem of malicious ...
- 101
1
vote
1
answer
174
views
Does flatpak enforce cryptographic authentication and integrity validation by default for all packages? (fedora)
Does the flatpak package manager in Fedora-based systems require successful cryptographic authentication and integrity validation for all packages?
I know that software downloaded with apt-get ...
- 998
0
votes
1
answer
203
views
Loop device added at package installation - is it a security threat?
I just noticed a strange loop device that was added to my machine today.
It is mounted under /run/media/<user>/CENA_X86FREE_EN-US_DV9 and seems to contain Windows files, probably a Windows ...
- 442
2
votes
1
answer
110
views
Does yum enforce cryptographic authentication and integrity validation by default for all packages? (CentOS, RHEL)
Does the yum package manager in CentOS/RHEL-based systems require successful cryptographic authentication and integrity validation for all packages?
I know that software downloaded with apt-get ...
- 998
1
vote
1
answer
170
views
Does rust's Cargo provide cryptographic authentication and integrity validation?
Does rust's cargo package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them?
I see a lot of guides ...
- 998
9
votes
2
answers
2k
views
Are devDependencies in Node.js exploitable?
I am well aware that the best approach is to update any dependency, no matter whether it is a development dependency or a runtime/production dependency.
But from a research prospective, I want to know ...
- 163
0
votes
0
answers
122
views
Cross signing practice for PGP package signing keys?
I consider WEB of trust as a failed initiative (search for SKS key poisoning mass occurred in 2019).
PGP is used to sign software in source (commits / tags in Git/Mercirual) & binary (compiled ...
- 123
0
votes
0
answers
160
views
Possibility of Man-in-the-middle Attack on Homebrew
It has been brought up in the past that package managers such as pip are vulnerable to man in the middle attacks (see https://www.reddit.com/r/Python/comments/17rfh7/...
- 77
0
votes
1
answer
179
views
Does pacman enforce cryptographic authentication and integrity validation by default for all packages? (arch linux)
Does the built-in pacman package manager in Arch-based systems require successful cryptographic authentication and integrity validation for all packages?
I know that software downloaded with apt-get ...
- 998
1
vote
0
answers
87
views
Does snapd enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)
Does the snapd package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages?
I know that software downloaded with apt-get packages ...
- 998
3
votes
1
answer
349
views
Does apt-get enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)
Does the built-in apt package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages?
My understanding was that software downloaded ...
- 998
3
votes
2
answers
1k
views
How to protect from dependency confusion attacks?
I recently came across following article
https://www.bleepingcomputer.com/news/security/researcher-hacks-over-35-tech-firms-in-novel-supply-chain-attack/
it describe about an exploit which exploit ...
- 181
0
votes
0
answers
104
views
Does yarn (Node.js package manager) provide cryptographic authentication and integrity validation?
Does the yarn package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them?
I see a lot of guides providing ...
- 998
-1
votes
1
answer
102
views
For package managers like pip, is it a better practice to install packages with the `--user` flag?
I understand that for most package managers (pip, brew, TeX tlmgr, etc) packages are typically not audited, so there are some inherent security risks in using these package managers. Sometimes the ...
- 1,680
2
votes
1
answer
366
views
Homebrew and NOPASSWD sudo
I like to be able to run some commands installed via Homebrew without typing my sudo password. The problem is that Homebrew installs everything with user permissions, so if I add the executables to ...
- 121
3
votes
2
answers
299
views
How much damage can a malicious package do with just "npm install <package>"?
I had a typo and npm installed something that is similar in name to something very popular -- I was concerned about typosquatting. It's quite plausibly legitimate and just a coincidence. I looked at ...
- 31
14
votes
3
answers
2k
views
Does python's pip provide cryptographic authentication and integrity validation?
Does python's pip package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them?
I see a lot of guides ...
- 998
0
votes
0
answers
647
views
Security implications of homebrew
I want to install homebrew in the safest possible way (single user system). It is often criticized that homebrew takes precedence over /usr/bin and /bin (in /etc/path) and therefore any malware can ...
1
vote
2
answers
279
views
The most secure way to allow downloading and installing an app on Mac, Windows, or Linux
I have been introduced to the anti-bash-script-piping stuff such as these:
Curl Bash Piping Wall of Shame (link broken)
Piping curl to s(hell)
Don't Pipe to your Shell
The hidden dangers of piping ...
- 618
3
votes
2
answers
580
views
Is it possible to block non-PyPI requests during pip install?
In 2017 and 2018 there were these infamous stories about malicious packages being uploaded to the PyPI (Python Package Index) which tried to do all sorts of things (collecting and sending data, ...
- 1,585
1
vote
1
answer
994
views
How secure is WebPack? [closed]
If NPM packages are so vulnerable as described in this article, is it acceptable to use WebPack for web-applications, in which security is a priority?
Edit: when using WebPack you should use NPM-...
- 13
9
votes
1
answer
3k
views
How Homebrew may impact your Mac's security [duplicate]
I read (here and here) that Homebrew (the Unix package manager) is a significant Mac security risk. An attack is allowed because Homebrew makes /usr/local/bin writable without root user privilege, ...
- 277
3
votes
2
answers
3k
views
Is it OK to not update devdependencies?
When checking third party libraries used in package.json and build.gradle files with tools such as Snyk, they allow the option to check for devdependencies. A lot of the time there is vulnerabilities ...
- 93
17
votes
2
answers
11k
views
What are the security implications of homebrew and macports?
macports
binaries are useable from /opt/local/bin/, i.e. for tesseract
bin$ which tesseract
/opt/local/bin/tesseract
bin$ ls /opt/local/bin/tesseract
-rwxr-xr-x 1 root admin 28120 15 Sep 2016 /...
8
votes
3
answers
1k
views
Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?
Recently, eslint-scope and eslint-config-eslint packages were hacked in an interesting way - one of the maintainer's account was compromised by an attacker and a new "patch" version with the malicious ...
- 1,585
3
votes
1
answer
580
views
Is there a security tracker aggregated file for Ubuntu server like Debian has?
Debian has a JSON file containing all CVE<->Fixed package versions map.
Link: https://security-tracker.debian.org/tracker/data/json
Does Ubuntu have something similar?
- 175
0
votes
0
answers
45
views
looking for computer readable lists of CVE to package name sources [duplicate]
Redhat has a very nice xml containing all known CVEs and the package version they are fixed in (https://www.redhat.com/security/data/metrics/rpm-to-cve.xml).
I would like to know if any other Linux ...
- 175
12
votes
1
answer
3k
views
Is it safe to use Python package managers like pip, easy_install or conda?
I know it is unsafe to install software (including Python packages) from not trusted or compromised sources.
However I wonder how safe I am when I am installing a trusted package from Python Package ...
- 293
4
votes
2
answers
972
views
Is the action of adding non-official repositories to Linux dangerous by itself?
Is the action of adding non-official (third party) repositories to Linux dangerous by itself?
For example, in Debian environments one could do:
add-apt-repository ppa:some_non_official_repository/...
5
votes
1
answer
258
views
Malicious NPM Package - Does it fit into OWASP Top Ten 2017?
On various security forums I have seen links to a post about a fictive malicious NPM package harvesting information. The posts title:
I’m harvesting credit card numbers and passwords from your site....
- 767
2
votes
2
answers
338
views
Why host third party libs instead of relying on CDN, Nuget, GitHub?
I'm struggling with some enterprise security guidelines requiring 3rd party libs to be hosted internally. The immediate concern is over our build server connecting to GitHub for package resolution, ...
- 21
1
vote
1
answer
566
views
IntelliJ PyCharm promiscuously installing packages
I have a Python/Pandas project where I tried to import and call sklearn.model_selection.train_test_split(). It wasn't working and I went to check if I'm missing some packages in project interpreter. ...
- 440
1
vote
1
answer
1k
views
Safety of packages through yum
Recently, a yum update installed an update to R1Soft's server backup management software on a Redhat 7 server I am dealing with, and rkhunter is giving me a warning about a suspicious file. I've asked ...
- 159
0
votes
0
answers
251
views
Does `npm install` retrieve binaries or sources?
I am starting to use npm install a lot for development, but I fear about its security consequences. Does npm install retrieve binaries or sources?
If it's binaries, it's already a deal breaker for ...
- 161
1
vote
1
answer
4k
views
What is "Linux Cert Store Sync" when installing "mono" package in my Linux? [duplicate]
While installing some package in my Arch Linux system, I noticed certificates import operation that added 157 new CAs, that is strange for me:
Synchronize local certs with certs from local Linux ...
- 11
2
votes
1
answer
613
views
How do (CVE patched) package versions relate?
Given the real-life example of an announced vulnerability fix, e.g. the latest openssl vulnerability fixes, and a Distro's reported throughput of the fix, e.g. GNU/Linux Debian's response to CVE-2016-...
- 45
1
vote
3
answers
673
views
Is Linux kernel supported by Linux Mint 17 LTS vulnerable?
During a local security check performed by nessus on a Linux Mint Qiana 17 LTS system, even if the host is perfectly updated, I have found 34 vulnerabilities about the kernel.
For example:
USN-2946-1 ...
- 1,328
0
votes
1
answer
447
views
Are the Linux community/universe repositories significantly less safe then the main repositories?
If so what makes community/universe less safe? Is there less testing or is it simply less safe because more people could put malware in them.
- 829
34
votes
1
answer
5k
views
Has malware ever been found in a package from a large Linux distribution and what is done to prevent this from occurring?
I am wondering exactly how safe are the Arch, Ubuntu, Mint and Manjaro repositories. What testing is done to ensure that a trusted user does not place a virus in a package, and how often?
- 829
1
vote
1
answer
155
views
Cryptography behind RedHat subscription system (DRM)?
I have to do a project like a subscription manager. Ideally this should work like RedHat subscriptions. I'm having a hard time figuring out how it was implemented. How do they manage to avoid a ...
- 153
3
votes
4
answers
801
views
Is the Linux / Debian software and package-management ecosystem secure?
My basic question is this:
When we are using the Linux / Debian apt-get or yum package system, we're placing a lot of faith in that the packages we're downloading and installing are secure. For that ...
- 141
16
votes
1
answer
900
views
Unpublished modules on npm: could an attacker take advantage of their former notoriety?
Earlier this week, Azer Koçulu decided to unpublish his modules from npm, the default package manager for Node.js. He had published 273 modules in total.
Some major modules, like Babel and React, ...
- 14.7k
5
votes
1
answer
189
views
Quantitative Security Analysis of Open Source Repos like CRAN and NPM
Is anyone aware of any quantitative analysis or research on the security of CRAN or NPM?
e.g. How much malware is hosted, rate of compromise, speed to close, number of attack vectors, CERT reports ...
- 181