Malware found on NPM infecting local package with reverse shell

tedd4u · 2025-03-26T19:27:08 1743017228

I think the industry is going to soon look back on building with Wild West open-source repos like we looked back on not having absolutely everything running on HTTPS in the Snowden era. I know Google has "assured" open source repos for Python and Java [1]. Are there other similar providers for those and other languages?

[1] https://cloud.google.com/assured-open-source-software/docs/o...

love2read · 2025-03-26T19:15:02 1743016502

The fact that http fetches and fs reads don't prompt the user are continually the craziest part of the `npx` and `package.json`'s `postinstall`.

Does anyone have a solution to wrap binary execution (or npm execution) and require explicit user authorization for network or fs calls?

2OEH8eoCRo0 · 2025-03-26T19:20:54 1743016854

Use Rust

user432678 · 2025-03-26T19:25:19 1743017119

According to the comment below, it should be “Use Java”.

JTbane · 2025-03-26T19:03:07 1743015787

Back in the day repositories had 'maintainers' who reviewed packages before they became included. I guess no one really cares in the web dev world; it's a free-for-all.

CamJN · 2025-03-26T19:13:39 1743016419

It’s not just web dev: go, rust, swift, ruby, python none of them do any checking.

In fact the only repo I know of doing any checking is Java’s Maven/Sonotype and it’s automated not manual.

debugnik · 2025-03-26T19:22:57 1743016977

OCaml's opam does have a review process, although I'm not sure how exhaustive. It's got a proper maintenance team checking for package compatibility, updating manifests and removing problematic versions.

I don't think this would be viable if the OCaml community grew larger though.

phito · 2025-03-26T19:16:16 1743016576

Malware in a crypto-related JavaScript package. Surprised Pikachu face

cute_boi · 2025-03-26T19:10:37 1743016237

I think they should start scanning package with the help of AI.

user432678 · 2025-03-26T19:24:49 1743017089

“Let’s 10x that shit”?

SunlitCat · 2025-03-26T19:29:15 1743017355

Nah! Then we would need to add some blockchain and maybe sprinkle some other Buzzwords here and there for good measurement!

curiousgal · 2025-03-26T19:13:14 1743016394

Water is wet.

（评论） (comments)

（评论）
(comments)