Hot answers tagged

10

Could malicious code be pushed to NPM? Most certainly. If a package is to become compromised (or a new one is published), installed, and used any code provided with that package could be executed. So if they run it in the node.js context for example, the attack has access to many machine level features such as the file system, system information, file ...


4

Three words: Supply Chain Management. Except that in our case the "supply" is dependency or "third party libraries". This isn't a unique problem to npm. This a general problem in software development. It's the equivalent of googling for a manufacturer of "screws" then use the first manufacturer of "screws" you see, don't ask about the specs of the "screws",...


2

Especially on npm there were known active attacks. The package cross-env was useful and used by many users, but the package crossenv would leak all your environment variables to another host. Someone took this to the extreme by registering a lot of packages in a lot of systems, which could have resulted in the compromise of 17000 hosts. Furthermore, ...


2

Of course there is a risk. Floss software doesn't eliminate malware, it just makes recognizing it possible. For a well-known big project, there will be some people looking at the code all the times, so that no single person can ever do anything bad. For smaller projects, you would need to check yourself if you want a guarantee that it is fine. And, of ...


2

They matter. Not updating libraries and dependencies will leave your software vulnerable. Each one of the libraries is part of the attack surface. Unless an update breaks your code, update as soon as the update is available. If the update breaks your code, patch the code and update. But never leave any outdated library with security bugs in your projects. ...


2

Basically the issue here is that 3rd party software tried to steal private information and send it out over the network. This issue is not unique to npm, any software running as your computer users could really do the same since there's nothing to stop it from reading your user data. As a line of defense against such an attack, you might consider using an ...


2

Supply chain management is the right answer in theory, however, despite the efforts of commercial entities like snyk and many others, there is no solution to this problem in the node ecosystem in practice. Node's supply chain record, with no disrespect intended to the numerous folks working to make it better, is uniquely awful. King of that infamous ...


2

The problem is independent of what technique you use to obtain your JS libraries. It doesn't matter if you use NPM packages, web-pack or manually copy&paste a folder of .js files. The problem is with using 3rd party code from untrustworthy sources and putting them into your web application without making sure they don't contain any malicious ...


2

These are several questions cramped into one, so I will try to answer each one individually: What is prototype pollution and how can it be used by an attacker? I don't know how much JavaScript knowledge you have, so I will try to remain as generic as possible. JavaScript uses prototypes extensively to implement object inheritance. Basically, whatever you ...


1

Conceptually, installing a package permits running setup scripts which in turn could be leveraged to execute arbitrary code on the system under the privileges of the executing user (hope it wasn't root... though if it was the worst consequence is full compromise of the system). The package may also pull in other packages as dependencies which in turn bring ...


1

You might want to take a look at https://snyk.io. It has a public Vulnerability DB including many npm packages. There you can search for your desired packages to get all known vulnerabilities. For example Angular JS: https://snyk.io/vuln/search?q=angular&type=npm To get an overview for a package you can use https://snyk.io/vuln/npm:<package>: ...


1

If you are searching for vulnerabilites in packages and software I would suggest to look in databases like https://cve.mitre.org/. There are all common vulnerabilities and exposures listed you are talking about. Just type your software into the search field and hit submit (like wordpress): https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wordpress BUT: ...


1

You have basically two options (provided you can verify your download, e.g., using a PGP signature): Read the code yourself Find some way to trust the developer Reading the code yourself will not only need a lot of time, but an evil developer has a lot of ways to hide a backdoor. So you will need to trust the library authors. The most important thing ...


1

That depends on what the dependencies are and what they're used for. Even if a dependency isn't used in production, if it's used as part of your build process, for example, then its possible that it might contain a vulnerability that affects your production code. Similarly, a vulnerability in a development tool could potentially allow attackers to ...


1

You can use https://snyk.io/ scanner. The dependencies of applications like react are really complex. There are same packages in multiple versions used. Also, such projects when they evolve they add more npm modules which makes it even more complex. When adding custom modules, it's good to make sure that they are in the most recent version, they are used by ...


1

It seems clear to me that a maliciously coded library is perfectly covered by A9:2017-Using Components with Known Vulnerabilities. I thought that A9 was created for this very use case. Although the wording from OWASP talks about older libraries that have vulnerabilities discovered over time (Heartbleed) and replaced, there is nothing in the wording that ...


1

According to npm issue #6886, there is a system for validating the contents of packages via any checksum or hashing system. Quote from GitHub user othiym23: npm has included validation of the package tarballs, via their SHA-1 digests, since pretty much the beginning. It's worth pointing out, though, that this is intended as a verification measure to ...


Only top voted, non community-wiki answers of a minimum length are eligible