Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [package-manager]

A package manager is a tool that automates the installation, updating and removal of software.

Filter by
Sorted by
Tagged with
0 votes
1 answer
40 views

What are other security risks associated with using package managers for internal companies libraries besides 3rd party trust

Assuming you have full trust in your package manager i.e. pip or npm (not to be compromised and leak your packages). And you have full trust in your developers to always install the correct packages. ...
Marc's user avatar
  • 1
0 votes
0 answers
36 views

Does GUIX provide cryptographic authentication and integrity validation?

Does the GNU GUIX package manager in require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get packages must be ...
Michael Altfield's user avatar
0 votes
0 answers
48 views

Does Node.js's npm provide cryptographic authentication and integrity validation?

Does Node.js's npm package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
Michael Altfield's user avatar
0 votes
1 answer
103 views

How is the npm package manager made robust security-wise, what are the keys they are using, and how do they use them?

I am specifically looking at the npm package metadata like from the lodash package, the relevant part which is this: { "shasum": "392617f69a947e40cec7848d85fcc3dd29d74bc5", &...
Lance's user avatar
  • 632
2 votes
1 answer
152 views

Distinguish origin of password prompts

I am wondering how to distinguish (password) prompts that the OS issued from prompts that are delivered application-side. This question first occurred to me when considering Firefox master passwords, ...
kaiyazeera's user avatar
0 votes
3 answers
149 views

Security and data protection reviews of npm packages

Does npm ensure that the packages are not spying on your data, saving it somewhere or is it the responsibility of the developer to ensure it? Can I confidently use the moderately well-known packages ...
user290234's user avatar
1 vote
3 answers
291 views

Supply chain risks for OS packages

The risks of supply chain attacks on software libraries is well documented, however, I have not seen much on OS packages/dependencies. How important is it to both 1) pin OS dependencies (apt,rpm,etc.) ...
user58446's user avatar
  • 563
1 vote
0 answers
87 views

Does Firefox's addon/extension installer provide cryptographic authentication and integrity validation?

Does Firefox's built-in installer for addons/extensions validate its payload's authentication and integrity for all files it downloads before actually installing them? I avoid in-app updates because, ...
Michael Altfield's user avatar
1 vote
0 answers
486 views

Restrict node.js filesystem access

I have a Node.js app which has a lot of npm-dependencies, running on Linux (Centos) machine. When Node starts, the script has access to the files outside its directory (as least by default), so ...
Oleg's user avatar
  • 309
12 votes
3 answers
4k views

How to vet third-party developer packages

Looking to create a form where developers can submit requests for packages to be installed. We want to create a list of questions that can help us determine whether or not a package is safe. What are ...
user277711's user avatar
0 votes
0 answers
383 views

How do you lock down PyPI access?

Another question (Is it possible to block non-PyPI requests during pip install?) asked about locking down non-PyPI pip installs for security reasons. This doesn't deal with the problem of malicious ...
Compholio's user avatar
  • 101
1 vote
1 answer
261 views

Does flatpak enforce cryptographic authentication and integrity validation by default for all packages? (fedora)

Does the flatpak package manager in Fedora-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get ...
Michael Altfield's user avatar
0 votes
1 answer
327 views

Loop device added at package installation - is it a security threat?

I just noticed a strange loop device that was added to my machine today. It is mounted under /run/media/<user>/CENA_X86FREE_EN-US_DV9 and seems to contain Windows files, probably a Windows ...
kaiya's user avatar
  • 452
2 votes
1 answer
165 views

Does yum enforce cryptographic authentication and integrity validation by default for all packages? (CentOS, RHEL)

Does the yum package manager in CentOS/RHEL-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get ...
Michael Altfield's user avatar
1 vote
1 answer
221 views

Does rust's Cargo provide cryptographic authentication and integrity validation?

Does rust's cargo package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
Michael Altfield's user avatar
10 votes
2 answers
3k views

Are devDependencies in Node.js exploitable?

I am well aware that the best approach is to update any dependency, no matter whether it is a development dependency or a runtime/production dependency. But from a research prospective, I want to know ...
LGDGODV's user avatar
  • 173
0 votes
0 answers
170 views

Cross signing practice for PGP package signing keys?

I consider WEB of trust as a failed initiative (search for SKS key poisoning mass occurred in 2019). PGP is used to sign software in source (commits / tags in Git/Mercirual) & binary (compiled ...
gavenkoa's user avatar
  • 123
0 votes
0 answers
197 views

Possibility of Man-in-the-middle Attack on Homebrew

It has been brought up in the past that package managers such as pip are vulnerable to man in the middle attacks (see https://www.reddit.com/r/Python/comments/17rfh7/...
Harrison G's user avatar
0 votes
1 answer
223 views

Does pacman enforce cryptographic authentication and integrity validation by default for all packages? (arch linux)

Does the built-in pacman package manager in Arch-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get ...
Michael Altfield's user avatar
1 vote
0 answers
111 views

Does snapd enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)

Does the snapd package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get packages ...
Michael Altfield's user avatar
4 votes
1 answer
433 views

Does apt-get enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)

Does the built-in apt package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages? My understanding was that software downloaded ...
Michael Altfield's user avatar
3 votes
2 answers
2k views

How to protect from dependency confusion attacks?

I recently came across following article https://www.bleepingcomputer.com/news/security/researcher-hacks-over-35-tech-firms-in-novel-supply-chain-attack/ it describe about an exploit which exploit ...
kaushalyap's user avatar
0 votes
0 answers
131 views

Does yarn (Node.js package manager) provide cryptographic authentication and integrity validation?

Does the yarn package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides providing ...
Michael Altfield's user avatar
-1 votes
1 answer
126 views

For package managers like pip, is it a better practice to install packages with the `--user` flag?

I understand that for most package managers (pip, brew, TeX tlmgr, etc) packages are typically not audited, so there are some inherent security risks in using these package managers. Sometimes the ...
gen's user avatar
  • 1,680
2 votes
1 answer
409 views

Homebrew and NOPASSWD sudo

I like to be able to run some commands installed via Homebrew without typing my sudo password. The problem is that Homebrew installs everything with user permissions, so if I add the executables to ...
HappyFace's user avatar
  • 121
3 votes
2 answers
369 views

How much damage can a malicious package do with just "npm install <package>"?

I had a typo and npm installed something that is similar in name to something very popular -- I was concerned about typosquatting. It's quite plausibly legitimate and just a coincidence. I looked at ...
user237586's user avatar
14 votes
3 answers
3k views

Does python's pip provide cryptographic authentication and integrity validation?

Does python's pip package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
Michael Altfield's user avatar
0 votes
0 answers
715 views

Security implications of homebrew

I want to install homebrew in the safest possible way (single user system). It is often criticized that homebrew takes precedence over /usr/bin and /bin (in /etc/path) and therefore any malware can ...
hidisem627's user avatar
1 vote
2 answers
309 views

The most secure way to allow downloading and installing an app on Mac, Windows, or Linux

I have been introduced to the anti-bash-script-piping stuff such as these: Curl Bash Piping Wall of Shame (link broken) Piping curl to s(hell) Don't Pipe to your Shell The hidden dangers of piping ...
Lance's user avatar
  • 632
3 votes
2 answers
625 views

Is it possible to block non-PyPI requests during pip install?

In 2017 and 2018 there were these infamous stories about malicious packages being uploaded to the PyPI (Python Package Index) which tried to do all sorts of things (collecting and sending data, ...
alecxe's user avatar
  • 1,605
1 vote
1 answer
1k views

How secure is WebPack? [closed]

If NPM packages are so vulnerable as described in this article, is it acceptable to use WebPack for web-applications, in which security is a priority? Edit: when using WebPack you should use NPM-...
Alex's user avatar
  • 13
9 votes
1 answer
4k views

How Homebrew may impact your Mac's security [duplicate]

I read (here and here) that Homebrew (the Unix package manager) is a significant Mac security risk. An attack is allowed because Homebrew makes /usr/local/bin writable without root user privilege, ...
Nick's user avatar
  • 279
3 votes
2 answers
3k views

Is it OK to not update devdependencies?

When checking third party libraries used in package.json and build.gradle files with tools such as Snyk, they allow the option to check for devdependencies. A lot of the time there is vulnerabilities ...
vegedezozu's user avatar
17 votes
2 answers
11k views

What are the security implications of homebrew and macports?

macports binaries are useable from /opt/local/bin/, i.e. for tesseract bin$ which tesseract /opt/local/bin/tesseract bin$ ls /opt/local/bin/tesseract -rwxr-xr-x 1 root admin 28120 15 Sep 2016 /...
Italian Philosophers 4 Monica's user avatar
8 votes
3 answers
1k views

Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?

Recently, eslint-scope and eslint-config-eslint packages were hacked in an interesting way - one of the maintainer's account was compromised by an attacker and a new "patch" version with the malicious ...
alecxe's user avatar
  • 1,605
3 votes
1 answer
629 views

Is there a security tracker aggregated file for Ubuntu server like Debian has?

Debian has a JSON file containing all CVE<->Fixed package versions map. Link: https://security-tracker.debian.org/tracker/data/json Does Ubuntu have something similar?
drdrek's user avatar
  • 175
0 votes
0 answers
45 views

looking for computer readable lists of CVE to package name sources [duplicate]

Redhat has a very nice xml containing all known CVEs and the package version they are fixed in (https://www.redhat.com/security/data/metrics/rpm-to-cve.xml). I would like to know if any other Linux ...
drdrek's user avatar
  • 175
12 votes
1 answer
3k views

Is it safe to use Python package managers like pip, easy_install or conda?

I know it is unsafe to install software (including Python packages) from not trusted or compromised sources. However I wonder how safe I am when I am installing a trusted package from Python Package ...
abukaj's user avatar
  • 293
4 votes
2 answers
1k views

Is the action of adding non-official repositories to Linux dangerous by itself?

Is the action of adding non-official (third party) repositories to Linux dangerous by itself? For example, in Debian environments one could do: add-apt-repository ppa:some_non_official_repository/...
Arcticooling's user avatar
4 votes
1 answer
278 views

Malicious NPM Package - Does it fit into OWASP Top Ten 2017?

On various security forums I have seen links to a post about a fictive malicious NPM package harvesting information. The posts title: I’m harvesting credit card numbers and passwords from your site....
Ogglas's user avatar
  • 777
2 votes
2 answers
362 views

Why host third party libs instead of relying on CDN, Nuget, GitHub?

I'm struggling with some enterprise security guidelines requiring 3rd party libs to be hosted internally. The immediate concern is over our build server connecting to GitHub for package resolution, ...
ajamrozek's user avatar
1 vote
1 answer
589 views

IntelliJ PyCharm promiscuously installing packages

I have a Python/Pandas project where I tried to import and call sklearn.model_selection.train_test_split(). It wasn't working and I went to check if I'm missing some packages in project interpreter. ...
bkoodaa's user avatar
  • 440
1 vote
1 answer
1k views

Safety of packages through yum

Recently, a yum update installed an update to R1Soft's server backup management software on a Redhat 7 server I am dealing with, and rkhunter is giving me a warning about a suspicious file. I've asked ...
Sommel's user avatar
  • 169
0 votes
0 answers
310 views

Does `npm install` retrieve binaries or sources?

I am starting to use npm install a lot for development, but I fear about its security consequences. Does npm install retrieve binaries or sources? If it's binaries, it's already a deal breaker for ...
knocte's user avatar
  • 161
1 vote
1 answer
4k views

What is "Linux Cert Store Sync" when installing "mono" package in my Linux? [duplicate]

While installing some package in my Arch Linux system, I noticed certificates import operation that added 157 new CAs, that is strange for me: Synchronize local certs with certs from local Linux ...
DLAccident's user avatar
2 votes
1 answer
685 views

How do (CVE patched) package versions relate?

Given the real-life example of an announced vulnerability fix, e.g. the latest openssl vulnerability fixes, and a Distro's reported throughput of the fix, e.g. GNU/Linux Debian's response to CVE-2016-...
woosting's user avatar
1 vote
3 answers
698 views

Is Linux kernel supported by Linux Mint 17 LTS vulnerable?

During a local security check performed by nessus on a Linux Mint Qiana 17 LTS system, even if the host is perfectly updated, I have found 34 vulnerabilities about the kernel. For example: USN-2946-1 ...
Sibwara's user avatar
  • 1,328
0 votes
1 answer
491 views

Are the Linux community/universe repositories significantly less safe then the main repositories?

If so what makes community/universe less safe? Is there less testing or is it simply less safe because more people could put malware in them.
user's user avatar
  • 829
34 votes
1 answer
5k views

Has malware ever been found in a package from a large Linux distribution and what is done to prevent this from occurring?

I am wondering exactly how safe are the Arch, Ubuntu, Mint and Manjaro repositories. What testing is done to ensure that a trusted user does not place a virus in a package, and how often?
user's user avatar
  • 829
1 vote
1 answer
173 views

Cryptography behind RedHat subscription system (DRM)?

I have to do a project like a subscription manager. Ideally this should work like RedHat subscriptions. I'm having a hard time figuring out how it was implemented. How do they manage to avoid a ...
Thilina's user avatar
  • 153