Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [package-manager]

A package manager is a tool that automates the installation, updating and removal of software.

0
votes
0answers
27 views

Is it possible to block non-PyPI requests during pip install?

In 2017 and 2018 there were these infamous stories about malicious packages being uploaded to the PyPI (Python Package Index) which tried to do all sorts of things (collecting and sending data, ...
0
votes
1answer
142 views

How secure is WebPack? [closed]

If NPM packages are so vulnerable as described in this article, is it acceptable to use WebPack for web-applications, in which security is a priority? Edit: when using WebPack you should use NPM-...
5
votes
1answer
289 views

How Homebrew may impact your Mac's security [duplicate]

I read (here and here) that Homebrew (the Unix package manager) is a significant Mac security risk. An attack is allowed because Homebrew makes /usr/local/bin writable without root user privilege, ...
1
vote
2answers
117 views

Is it OK to not update devdependencies?

When checking third party libraries used in package.json and build.gradle files with tools such as Snyk, they allow the option to check for devdependencies. A lot of the time there is vulnerabilities ...
2
votes
1answer
1k views

What are the security implications of homebrew and macports?

macports binaries are useable from /opt/local/bin/, i.e. for tesseract bin$ which tesseract /opt/local/bin/tesseract bin$ ls /opt/local/bin/tesseract -rwxr-xr-x 1 root admin 28120 15 Sep 2016 /...
7
votes
3answers
745 views

Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?

Recently, eslint-scope and eslint-config-eslint packages were hacked in an interesting way - one of the maintainer's account was compromised by an attacker and a new "patch" version with the malicious ...
3
votes
1answer
127 views

Is there a security tracker aggregated file for Ubuntu server like Debian has?

Debian has a JSON file containing all CVE<->Fixed package versions map. Link: https://security-tracker.debian.org/tracker/data/json Does Ubuntu have something similar?
0
votes
0answers
38 views

looking for computer readable lists of CVE to package name sources [duplicate]

Redhat has a very nice xml containing all known CVEs and the package version they are fixed in (https://www.redhat.com/security/data/metrics/rpm-to-cve.xml). I would like to know if any other Linux ...
9
votes
1answer
924 views

Is it safe to use Python package managers like pip, easy_install or conda?

I know it is unsafe to install software (including Python packages) from not trusted or compromised sources. However I wonder how safe I am when I am installing a trusted package from Python Package ...
3
votes
2answers
83 views

Is the action of adding non-official repositories to Linux dangerous by itself?

Is the action of adding non-official (third party) repositories to Linux dangerous by itself? For example, in Debian environments one could do: add-apt-repository ppa:some_non_official_repository/...
5
votes
1answer
180 views

Malicious NPM Package - Does it fit into OWASP Top Ten 2017?

On various security forums I have seen links to a post about a fictive malicious NPM package harvesting information. The posts title: I’m harvesting credit card numbers and passwords from your site....
2
votes
2answers
146 views

Why host third party libs instead of relying on CDN, Nuget, GitHub?

I'm struggling with some enterprise security guidelines requiring 3rd party libs to be hosted internally. The immediate concern is over our build server connecting to GitHub for package resolution, ...
1
vote
1answer
391 views

IntelliJ PyCharm promiscuously installing packages

I have a Python/Pandas project where I tried to import and call sklearn.model_selection.train_test_split(). It wasn't working and I went to check if I'm missing some packages in project interpreter. ...
0
votes
1answer
393 views

Safety of packages through yum

Recently, a yum update installed an update to R1Soft's server backup management software on a Redhat 7 server I am dealing with, and rkhunter is giving me a warning about a suspicious file. I've asked ...
0
votes
0answers
57 views

Does `npm install` retrieve binaries or sources?

I am starting to use npm install a lot for development, but I fear about its security consequences. Does npm install retrieve binaries or sources? If it's binaries, it's already a deal breaker for ...
0
votes
1answer
2k views

What is “Linux Cert Store Sync” when installing “mono” package in my Linux? [duplicate]

While installing some package in my Arch Linux system, I noticed certificates import operation that added 157 new CAs, that is strange for me: Synchronize local certs with certs from local Linux ...
2
votes
1answer
272 views

How do (CVE patched) package versions relate?

Given the real-life example of an announced vulnerability fix, e.g. the latest openssl vulnerability fixes, and a Distro's reported throughput of the fix, e.g. GNU/Linux Debian's response to CVE-2016-...
1
vote
3answers
516 views

Is Linux kernel supported by Linux Mint 17 LTS vulnerable?

During a local security check performed by nessus on a Linux Mint Qiana 17 LTS system, even if the host is perfectly updated, I have found 34 vulnerabilities about the kernel. For example: USN-2946-1 ...
0
votes
1answer
131 views

Are the Linux community/universe repositories significantly less safe then the main repositories?

If so what makes community/universe less safe? Is there less testing or is it simply less safe because more people could put malware in them.
30
votes
1answer
3k views

Has malware ever been found in a package from a large Linux distribution and what is done to prevent this from occurring?

I am wondering exactly how safe are the Arch, Ubuntu, Mint and Manjaro repositories. What testing is done to ensure that a trusted user does not place a virus in a package, and how often?
1
vote
1answer
96 views

Cryptography behind RedHat subscription system (DRM)?

I have to do a project like a subscription manager. Ideally this should work like RedHat subscriptions. I'm having a hard time figuring out how it was implemented. How do they manage to avoid a ...
3
votes
3answers
171 views

Is the Linux / Debian software and package-management ecosystem secure?

My basic question is this: When we are using the Linux / Debian apt-get or yum package system, we're placing a lot of faith in that the packages we're downloading and installing are secure. For that ...
14
votes
1answer
634 views

Unpublished modules on npm: could an attacker take advantage of their former notoriety?

Earlier this week, Azer Koçulu decided to unpublish his modules from npm, the default package manager for Node.js. He had published 273 modules in total. Some major modules, like Babel and React, ...
5
votes
1answer
126 views

Quantitative Security Analysis of Open Source Repos like CRAN and NPM

Is anyone aware of any quantitative analysis or research on the security of CRAN or NPM? e.g. How much malware is hosted, rate of compromise, speed to close, number of attack vectors, CERT reports ...
6
votes
2answers
997 views

What risks are involved with installing gems from rubygems.org? Are alternatives safer?

Normally, when installing a Ruby gem, I'd ask my system admin to do sudo gem install gemname However, there was recently a security breach with the source of gems, http://rubygems.org , and I'm ...