Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [package-manager]

A package manager is a tool that automates the installation, updating and removal of software.

Filter by
Sorted by
Tagged with
12 votes
3 answers
4k views

How to vet third-party developer packages

Looking to create a form where developers can submit requests for packages to be installed. We want to create a list of questions that can help us determine whether or not a package is safe. What are ...
user avatar
0 votes
0 answers
43 views

How do you lock down PyPI access?

Another question (Is it possible to block non-PyPI requests during pip install?) asked about locking down non-PyPI pip installs for security reasons. This doesn't deal with the problem of malicious ...
user avatar
  • 101
0 votes
0 answers
20 views

what are the risk associated with installing flatpaks at user level

flatkill has been floating around for a while, and honestly it was the reason I was personally resistant to using flatpak packages for a while. I'm wondering though, most of the article is written ...
user avatar
1 vote
0 answers
41 views

Does flatpak enforce cryptographic authentication and integrity validation by default for all packages? (fedora)

Does the flatpak package manager in Fedora-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get ...
user avatar
0 votes
1 answer
86 views

Loop device added at package installation - is it a security threat?

I just noticed a strange loop device that was added to my machine today. It is mounted under /run/media/<user>/CENA_X86FREE_EN-US_DV9 and seems to contain Windows files, probably a Windows ...
user avatar
  • 422
2 votes
1 answer
54 views

Does yum enforce cryptographic authentication and integrity validation by default for all packages? (CentOS, RHEL)

Does the yum package manager in CentOS/RHEL-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get ...
user avatar
1 vote
1 answer
109 views

Does rust's Cargo provide cryptographic authentication and integrity validation?

Does rust's cargo package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
user avatar
6 votes
2 answers
750 views

Are devDependencies in Node.js exploitable?

I am well aware that the best approach is to update any dependency, no matter whether it is a development dependency or a runtime/production dependency. But from a research prospective, I want to know ...
user avatar
  • 133
0 votes
0 answers
74 views

Cross signing practice for PGP package signing keys?

I consider WEB of trust as a failed initiative (search for SKS key poisoning mass occurred in 2019). PGP is used to sign software in source (commits / tags in Git/Mercirual) & binary (compiled ...
user avatar
  • 113
0 votes
0 answers
102 views

Possibility of Man-in-the-middle Attack on Homebrew

It has been brought up in the past that package managers such as pip are vulnerable to man in the middle attacks (see https://www.reddit.com/r/Python/comments/17rfh7/...
user avatar
0 votes
0 answers
72 views

Does dnf enforce cryptographic authentication and integrity validation by default for all packages? (fedora linux)

Does the built-in dnf package manager in Fedora-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get ...
user avatar
0 votes
1 answer
100 views

Does pacman enforce cryptographic authentication and integrity validation by default for all packages? (arch linux)

Does the built-in pacman package manager in Arch-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get ...
user avatar
1 vote
0 answers
80 views

Does snapd enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)

Does the snapd package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get packages ...
user avatar
2 votes
1 answer
168 views

Does apt-get enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)

Does the built-in apt package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages? My understanding was that software downloaded ...
user avatar
3 votes
2 answers
1k views

How to protect from dependency confusion attacks?

I recently came across following article https://www.bleepingcomputer.com/news/security/researcher-hacks-over-35-tech-firms-in-novel-supply-chain-attack/ it describe about an exploit which exploit ...
user avatar
  • 181
0 votes
0 answers
85 views

Does yarn (Node.js package manager) provide cryptographic authentication and integrity validation?

Does the yarn package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides providing ...
user avatar
-1 votes
1 answer
89 views

For package managers like pip, is it a better practice to install packages with the `--user` flag?

I understand that for most package managers (pip, brew, TeX tlmgr, etc) packages are typically not audited, so there are some inherent security risks in using these package managers. Sometimes the ...
user avatar
  • 1,670
2 votes
1 answer
257 views

Homebrew and NOPASSWD sudo

I like to be able to run some commands installed via Homebrew without typing my sudo password. The problem is that Homebrew installs everything with user permissions, so if I add the executables to ...
user avatar
  • 121
3 votes
2 answers
191 views

How much damage can a malicious package do with just "npm install <package>"?

I had a typo and npm installed something that is similar in name to something very popular -- I was concerned about typosquatting. It's quite plausibly legitimate and just a coincidence. I looked at ...
user avatar
11 votes
3 answers
1k views

Does python's pip provide cryptographic authentication and integrity validation?

Does python's pip package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
user avatar
0 votes
0 answers
528 views

Security implications of homebrew

I want to install homebrew in the safest possible way (single user system). It is often criticized that homebrew takes precedence over /usr/bin and /bin (in /etc/path) and therefore any malware can ...
user avatar
1 vote
2 answers
209 views

The most secure way to allow downloading and installing an app on Mac, Windows, or Linux

I have been introduced to the anti-bash-script-piping stuff such as these: Curl Bash Piping Wall of Shame (link broken) Piping curl to s(hell) Don't Pipe to your Shell The hidden dangers of piping ...
user avatar
  • 548
3 votes
2 answers
456 views

Is it possible to block non-PyPI requests during pip install?

In 2017 and 2018 there were these infamous stories about malicious packages being uploaded to the PyPI (Python Package Index) which tried to do all sorts of things (collecting and sending data, ...
user avatar
  • 1,495
1 vote
1 answer
817 views

How secure is WebPack? [closed]

If NPM packages are so vulnerable as described in this article, is it acceptable to use WebPack for web-applications, in which security is a priority? Edit: when using WebPack you should use NPM-...
user avatar
  • 13
9 votes
1 answer
2k views

How Homebrew may impact your Mac's security [duplicate]

I read (here and here) that Homebrew (the Unix package manager) is a significant Mac security risk. An attack is allowed because Homebrew makes /usr/local/bin writable without root user privilege, ...
user avatar
  • 247
3 votes
2 answers
2k views

Is it OK to not update devdependencies?

When checking third party libraries used in package.json and build.gradle files with tools such as Snyk, they allow the option to check for devdependencies. A lot of the time there is vulnerabilities ...
user avatar
16 votes
2 answers
8k views

What are the security implications of homebrew and macports?

macports binaries are useable from /opt/local/bin/, i.e. for tesseract bin$ which tesseract /opt/local/bin/tesseract bin$ ls /opt/local/bin/tesseract -rwxr-xr-x 1 root admin 28120 15 Sep 2016 /...
user avatar
8 votes
3 answers
1k views

Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?

Recently, eslint-scope and eslint-config-eslint packages were hacked in an interesting way - one of the maintainer's account was compromised by an attacker and a new "patch" version with the malicious ...
user avatar
  • 1,495
3 votes
1 answer
480 views

Is there a security tracker aggregated file for Ubuntu server like Debian has?

Debian has a JSON file containing all CVE<->Fixed package versions map. Link: https://security-tracker.debian.org/tracker/data/json Does Ubuntu have something similar?
user avatar
  • 165
0 votes
0 answers
45 views

looking for computer readable lists of CVE to package name sources [duplicate]

Redhat has a very nice xml containing all known CVEs and the package version they are fixed in (https://www.redhat.com/security/data/metrics/rpm-to-cve.xml). I would like to know if any other Linux ...
user avatar
  • 165
12 votes
1 answer
3k views

Is it safe to use Python package managers like pip, easy_install or conda?

I know it is unsafe to install software (including Python packages) from not trusted or compromised sources. However I wonder how safe I am when I am installing a trusted package from Python Package ...
user avatar
  • 273
3 votes
2 answers
598 views

Is the action of adding non-official repositories to Linux dangerous by itself?

Is the action of adding non-official (third party) repositories to Linux dangerous by itself? For example, in Debian environments one could do: add-apt-repository ppa:some_non_official_repository/...
user avatar
5 votes
1 answer
246 views

Malicious NPM Package - Does it fit into OWASP Top Ten 2017?

On various security forums I have seen links to a post about a fictive malicious NPM package harvesting information. The posts title: I’m harvesting credit card numbers and passwords from your site....
user avatar
  • 675
2 votes
2 answers
321 views

Why host third party libs instead of relying on CDN, Nuget, GitHub?

I'm struggling with some enterprise security guidelines requiring 3rd party libs to be hosted internally. The immediate concern is over our build server connecting to GitHub for package resolution, ...
user avatar
1 vote
1 answer
544 views

IntelliJ PyCharm promiscuously installing packages

I have a Python/Pandas project where I tried to import and call sklearn.model_selection.train_test_split(). It wasn't working and I went to check if I'm missing some packages in project interpreter. ...
user avatar
1 vote
1 answer
875 views

Safety of packages through yum

Recently, a yum update installed an update to R1Soft's server backup management software on a Redhat 7 server I am dealing with, and rkhunter is giving me a warning about a suspicious file. I've asked ...
user avatar
  • 159
0 votes
0 answers
107 views

Does `npm install` retrieve binaries or sources?

I am starting to use npm install a lot for development, but I fear about its security consequences. Does npm install retrieve binaries or sources? If it's binaries, it's already a deal breaker for ...
user avatar
  • 161
1 vote
1 answer
4k views

What is "Linux Cert Store Sync" when installing "mono" package in my Linux? [duplicate]

While installing some package in my Arch Linux system, I noticed certificates import operation that added 157 new CAs, that is strange for me: Synchronize local certs with certs from local Linux ...
user avatar
2 votes
1 answer
452 views

How do (CVE patched) package versions relate?

Given the real-life example of an announced vulnerability fix, e.g. the latest openssl vulnerability fixes, and a Distro's reported throughput of the fix, e.g. GNU/Linux Debian's response to CVE-2016-...
user avatar
1 vote
3 answers
644 views

Is Linux kernel supported by Linux Mint 17 LTS vulnerable?

During a local security check performed by nessus on a Linux Mint Qiana 17 LTS system, even if the host is perfectly updated, I have found 34 vulnerabilities about the kernel. For example: USN-2946-1 ...
user avatar
  • 1,336
0 votes
1 answer
339 views

Are the Linux community/universe repositories significantly less safe then the main repositories?

If so what makes community/universe less safe? Is there less testing or is it simply less safe because more people could put malware in them.
user avatar
  • 817
33 votes
1 answer
4k views

Has malware ever been found in a package from a large Linux distribution and what is done to prevent this from occurring?

I am wondering exactly how safe are the Arch, Ubuntu, Mint and Manjaro repositories. What testing is done to ensure that a trusted user does not place a virus in a package, and how often?
user avatar
  • 817
1 vote
1 answer
144 views

Cryptography behind RedHat subscription system (DRM)?

I have to do a project like a subscription manager. Ideally this should work like RedHat subscriptions. I'm having a hard time figuring out how it was implemented. How do they manage to avoid a ...
user avatar
  • 153
3 votes
4 answers
490 views

Is the Linux / Debian software and package-management ecosystem secure?

My basic question is this: When we are using the Linux / Debian apt-get or yum package system, we're placing a lot of faith in that the packages we're downloading and installing are secure. For that ...
user avatar
  • 141
16 votes
1 answer
820 views

Unpublished modules on npm: could an attacker take advantage of their former notoriety?

Earlier this week, Azer Koçulu decided to unpublish his modules from npm, the default package manager for Node.js. He had published 273 modules in total. Some major modules, like Babel and React, ...
user avatar
5 votes
1 answer
181 views

Quantitative Security Analysis of Open Source Repos like CRAN and NPM

Is anyone aware of any quantitative analysis or research on the security of CRAN or NPM? e.g. How much malware is hosted, rate of compromise, speed to close, number of attack vectors, CERT reports ...
user avatar
  • 181
6 votes
2 answers
1k views

What risks are involved with installing gems from rubygems.org? Are alternatives safer?

Normally, when installing a Ruby gem, I'd ask my system admin to do sudo gem install gemname However, there was recently a security breach with the source of gems, http://rubygems.org , and I'm ...
user avatar
  • 2,100