I always advocate switching to pnpm where install scripts are disabled by default. It has plenty of security features to ward off most supply chain attacks.
Does disabling install scripts actually do anything though? The attack would still work if put in the code itself, no? The only difference I can see is that it would run when the project is run instead of when the package is installed.
On closer inspection, preventing post-install would have fixed it too: "The attack exploited a transitive dependency, plain-crypto-js@4.2.1, which executed a postinstall script to deploy the RAT."
12 Comments
eskuero@lemmy.fromshado.ws · 36 pts · 158d
You can mitigate similar attacks by editing your .npmrc
PetteriPano@lemmy.world · 37 pts · 158d
It's a good way to keep the exploit around for seven days, too, if you apply it right away.
taco_shale032@lemmy.ml · 8 pts · 158d
I agree, I think it would be better to use something like dependabot or renovatebot so you can know of and apply security updates right away.
eskuero@lemmy.fromshado.ws · 11 pts · 158d
As long as the bot is not allowed to automatically merge minor version bumps in libraries...
magikmw@piefed.social · 3 pts · 158d
Well yes, one can misuse any tool.
eskuero@lemmy.fromshado.ws · 2 pts · 157d
How? If you got hit by this you are looking at restoring the system from a safe previous version.
And the compromised versions get pulled, not superseeded by a new release, so once you rebuild you would go back to a safe version...
TechnoCat@piefed.social · 22 pts · 158d
I always advocate switching to
pnpmwhere install scripts are disabled by default. It has plenty of security features to ward off most supply chain attacks.techpeakedin1991@lemmy.ml · 5 pts · 158d
Does disabling install scripts actually do anything though? The attack would still work if put in the code itself, no? The only difference I can see is that it would run when the project is run instead of when the package is installed.
TechnoCat@piefed.social · 4 pts · 157d
On closer inspection, preventing post-install would have fixed it too: "The attack exploited a transitive dependency, plain-crypto-js@4.2.1, which executed a postinstall script to deploy the RAT."
TechnoCat@piefed.social · 4 pts · 157d
Minimum age would have prevented it in this case.
prettygorgeous@aussie.zone · 1 pts · 157d
Just ask Australian how well minimum age verification works!
fizzle@quokk.au · 7 pts · 158d
Doesn't seem to have been live for very long.