44
votes
Accepted
How to vet third-party developer packages
I highly doubt that a process to request approvals for new third-party packages will have the desired effects. I've worked for organizations that have tried to introduce similar processes, and they ...
- 1,062
11
votes
Accepted
Unpublished modules on npm: could an attacker take advantage of their former notoriety?
Could malicious code be pushed to NPM?
Most certainly. If a package is to become compromised (or a new one is published), installed, and used any code provided with that package could be executed. So ...
- 3,362
6
votes
Are devDependencies in Node.js exploitable?
It depends on the vulnerability, and on the threat environment (as is true for every component, not just development ones). Here are a few (generic) examples:
A tool that fetches an external script ...
- 46.3k
5
votes
Accepted
Are devDependencies in Node.js exploitable?
While running the npm start command and the dev env set to development or running a special command (like npm run dev, where dev is a special script which starts up a local development environment as ...
- 1,552
4
votes
Is it OK to not update devdependencies?
That depends on what the dependencies are and what they're used for.
Even if a dependency isn't used in production, if it's used as part of your build process, for example, then its possible that it ...
- 4,733
4
votes
Accepted
Is it OK to not update devdependencies?
They matter. Not updating libraries and dependencies will leave your software vulnerable. Each one of the libraries is part of the attack surface.
Unless an update breaks your code, update as soon as ...
- 53.5k
4
votes
Accepted
Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?
Three words: Supply Chain Management. Except that in our case the "supply" is dependency or "third party libraries".
This isn't a unique problem to npm. This a general problem in software ...
- 565
3
votes
Accepted
How can the validity and safety of a software library be checked?
You have basically two options (provided you can verify your download, e.g., using a PGP signature):
Read the code yourself
Find some way to trust the developer
Reading the code yourself will not ...
- 3,382
2
votes
Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?
Basically the issue here is that 3rd party software tried to steal private information and send it out over the network. This issue is not unique to npm, any software running as your computer users ...
- 8,834
2
votes
Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?
Supply chain management is the right answer in theory, however, despite the efforts of commercial entities like snyk and many others, there is no solution to this problem in the node ecosystem in ...
- 3,487
2
votes
How secure open source packages are?
Especially on npm there were known active attacks.
The package cross-env was useful and used by many users, but the package crossenv would leak all your environment variables to another host.
...
- 29.6k
2
votes
How secure open source packages are?
Of course there is a risk.
Floss software doesn't eliminate malware, it just makes recognizing it possible. For a well-known big project, there will be some people looking at the code all the times,...
- 431
2
votes
Accepted
How secure is WebPack?
The problem is independent of what technique you use to obtain your JS libraries. It doesn't matter if you use NPM packages, web-pack or manually copy&paste a folder of .js files. The problem is ...
- 49.3k
2
votes
Accepted
How to securely use `pass`, `sudo`, and `npm` on the same machine
running npm i ... not long after pass my-password allows a malicious package to steal my entire password store
Yes, but not just that. Running npm i ... at any time before pass my-password allows a ...
1
vote
Where to query for CVEs present in a version of a software project like npm packages of python modules?
Your requirements are very specific and I doubt that exactly such a service exists. The cve-search project provides tools that could be utilized to process CVE data locally, which could be used to get ...
- 18.7k
1
vote
How is the npm package manager made robust security-wise, what are the keys they are using, and how do they use them?
The shasum entry is the SHA-1 hash of the file. It has become obsolete with the introduction of integrity.
For integrity, the format of Subresource Integrity is used. As you already found out, this is ...
- 3,438
1
vote
How does npm’s ECDSA signing system improve security?
NPM's signatures allow you to check that when you have a copy of the package, that it has the same contents as the package in the NPM registry. Thus, you can prove that a downloaded copy was not ...
- 1,316
1
vote
Is there a way to check if vulnerability introduced by npm package is reachable/exploitable
The standard approach to prioritize vulnerability management is to focus on severity level. You should focus on Critical vulnerabilities first,then High etc.
As suggested by Robert, it's not practical ...
- 1,982
1
vote
How much damage can a malicious package do with just "npm install <package>"?
Conceptually, installing a package permits running setup scripts which in turn could be leveraged to execute arbitrary code on the system under the privileges of the executing user (hope it wasn't ...
- 3,931
1
vote
Which database is used by npm-audit
As of Oct 7 2021, npm audit relies on GitHub Advisory Database: GitHub Advisory Database now powers npm audit.
1
vote
Accepted
How do I get the "vulnerabilities history" of a Node.js package?
You might want to take a look at https://snyk.io. It has a public Vulnerability DB including many npm packages. There you can search for your desired packages to get all known vulnerabilities.
For ...
- 640
1
vote
How do I get the "vulnerabilities history" of a Node.js package?
If you are searching for vulnerabilites in packages and software I would suggest to look in databases like https://cve.mitre.org/. There are all common vulnerabilities and exposures listed you are ...
- 638
1
vote
How is the create-react-app package tree properly sanitized?
You can use https://snyk.io/ scanner.
The dependencies of applications like react are really complex. There are same packages in multiple versions used. Also, such projects when they evolve they add ...
- 2,731
1
vote
Malicious NPM Package - Does it fit into OWASP Top Ten 2017?
It seems clear to me that a maliciously coded library is perfectly covered by A9:2017-Using Components with Known Vulnerabilities. I thought that A9 was created for this very use case.
Although the ...
- 128k
1
vote
Accepted
How do atom's apm and npm verify package integrity?
According to npm issue #6886, there is a system for validating the contents of packages via any checksum or hashing system.
Quote from GitHub user othiym23:
npm has included validation of the ...
- 226
Only top scored, non community-wiki answers of a minimum length are eligible