▲ 98 ▼ Dozens of Red Hat packages backdoored through its official NPM channel (arstechnica.com) submitted 5 months ago by schnurrito@discuss.tchncs.de to c/cybersecurity@sh.itjust.works 19 comments fedilink hide all child comments
[–] davidgro@lemmy.world 48 points 5 months ago (9 children) I'm beginning to think this "NPM" thing isn't a great idea. permalink fedilink source hideshow 9 child comments replies: [–] ztwhixsemhwldvka@lemmy.world 20 points 5 months ago Its always npm permalink fedilink source parent [–] NotSteve_@lemmy.ca 4 points 5 months ago (3 children) I don't really see how it's NPM at fault here. This was caused by a malicious actor taking control of an account and putting out bad packages on it. It could happen on any package repository for any language permalink fedilink source parent hideshow 3 child comments replies: [–] davidgro@lemmy.world 6 points 5 months ago (1 child) My understanding is that for most package managers the signing keys are held by a smallish number of maintainers responsible for entire sections, who presumably keep those accounts pretty tightly secured. Not impossible to take over, but it's a smaller attack surface. While for NPM as far as I know every uploader keeps their own account and there's not even signing keys to lose control of. permalink fedilink source parent hideshow 1 child comment replies: [–] hirihit640@sh.itjust.works 4 points 5 months ago I've heard quite a few PyPi and Cargo attacks though, but I bet the main reason why hear NPM so much is simply because NPM is the biggest, and thus the most valuable target permalink fedilink source parent [–] MonkderVierte@lemmy.zip 4 points 5 months ago Trust by default for a atomic packaging system. Entirely NPM's fault. permalink fedilink source parent [–] Fizz@lemmy.nz 3 points 5 months ago (3 children) I'm not familiar with npm but why is this always NPM? Is it a specific issue they have? permalink fedilink source parent hideshow 3 child comments replies: [–] knobbysideup@sh.itjust.works 27 points 5 months ago (1 child) It's a "package manager" that has zero integrity checks built in. Web devs also love it. Nice combination. permalink fedilink source parent hideshow 1 child comment replies: [–] MonkderVierte@lemmy.zip 2 points 5 months ago Culture problem imo. permalink fedilink source parent [–] hirihit640@sh.itjust.works 1 point 5 months ago because it's the biggest. Just like how hackers target windows and not linux (assuming they are targeting users and not servers). permalink fedilink source parent
[–] ztwhixsemhwldvka@lemmy.world 20 points 5 months ago Its always npm permalink fedilink source parent
[–] NotSteve_@lemmy.ca 4 points 5 months ago (3 children) I don't really see how it's NPM at fault here. This was caused by a malicious actor taking control of an account and putting out bad packages on it. It could happen on any package repository for any language permalink fedilink source parent hideshow 3 child comments replies: [–] davidgro@lemmy.world 6 points 5 months ago (1 child) My understanding is that for most package managers the signing keys are held by a smallish number of maintainers responsible for entire sections, who presumably keep those accounts pretty tightly secured. Not impossible to take over, but it's a smaller attack surface. While for NPM as far as I know every uploader keeps their own account and there's not even signing keys to lose control of. permalink fedilink source parent hideshow 1 child comment replies: [–] hirihit640@sh.itjust.works 4 points 5 months ago I've heard quite a few PyPi and Cargo attacks though, but I bet the main reason why hear NPM so much is simply because NPM is the biggest, and thus the most valuable target permalink fedilink source parent [–] MonkderVierte@lemmy.zip 4 points 5 months ago Trust by default for a atomic packaging system. Entirely NPM's fault. permalink fedilink source parent
[–] davidgro@lemmy.world 6 points 5 months ago (1 child) My understanding is that for most package managers the signing keys are held by a smallish number of maintainers responsible for entire sections, who presumably keep those accounts pretty tightly secured. Not impossible to take over, but it's a smaller attack surface. While for NPM as far as I know every uploader keeps their own account and there's not even signing keys to lose control of. permalink fedilink source parent hideshow 1 child comment replies: [–] hirihit640@sh.itjust.works 4 points 5 months ago I've heard quite a few PyPi and Cargo attacks though, but I bet the main reason why hear NPM so much is simply because NPM is the biggest, and thus the most valuable target permalink fedilink source parent
[–] hirihit640@sh.itjust.works 4 points 5 months ago I've heard quite a few PyPi and Cargo attacks though, but I bet the main reason why hear NPM so much is simply because NPM is the biggest, and thus the most valuable target permalink fedilink source parent
[–] MonkderVierte@lemmy.zip 4 points 5 months ago Trust by default for a atomic packaging system. Entirely NPM's fault. permalink fedilink source parent
[–] Fizz@lemmy.nz 3 points 5 months ago (3 children) I'm not familiar with npm but why is this always NPM? Is it a specific issue they have? permalink fedilink source parent hideshow 3 child comments replies: [–] knobbysideup@sh.itjust.works 27 points 5 months ago (1 child) It's a "package manager" that has zero integrity checks built in. Web devs also love it. Nice combination. permalink fedilink source parent hideshow 1 child comment replies: [–] MonkderVierte@lemmy.zip 2 points 5 months ago Culture problem imo. permalink fedilink source parent [–] hirihit640@sh.itjust.works 1 point 5 months ago because it's the biggest. Just like how hackers target windows and not linux (assuming they are targeting users and not servers). permalink fedilink source parent
[–] knobbysideup@sh.itjust.works 27 points 5 months ago (1 child) It's a "package manager" that has zero integrity checks built in. Web devs also love it. Nice combination. permalink fedilink source parent hideshow 1 child comment replies: [–] MonkderVierte@lemmy.zip 2 points 5 months ago Culture problem imo. permalink fedilink source parent
[–] MonkderVierte@lemmy.zip 2 points 5 months ago Culture problem imo. permalink fedilink source parent
[–] hirihit640@sh.itjust.works 1 point 5 months ago because it's the biggest. Just like how hackers target windows and not linux (assuming they are targeting users and not servers). permalink fedilink source parent