[Potential Drama] :marseykingcrown: adds malicious code to over 35k GitHub repos

https://twitter.com/stephenlacy/status/1554697077430505473
88
Jump in the discussion.

No email address required.

Any JS developer who isn't using locked NPM package.json versions in 2022 deserves to be hacked by Russians

Every smart dev I know did this 2yrs ago when the state of this NPM shit came to light

Edit: rDrama doesnt even use NPM, they download .js libraries like its 2007 https://github.com/Aevann1/rDrama/tree/frost/files/assets

Jump in the discussion.

No email address required.

>rDrama doesnt even use NPM, they download .js libraries like its 2007

When we say we want the Internet to go back to 2007 we mean it.

:!marseykneel: :marseycapychad2: :marseykneel:

Jump in the discussion.

No email address required.

Kings

Jump in the discussion.

No email address required.

I love typoescript but hate this npm shit, is there any way for me? :(

Fixed typing is just so much more convenient to find bugs early

Jump in the discussion.

No email address required.

Learn rust

Jump in the discussion.

No email address required.

Lmao

Jump in the discussion.

No email address required.

NPM is bloated

Jump in the discussion.

No email address required.

Rails bundler and a bundled of other package managers have the same risks.

The problem is mostly how js encourages a thousand small dependencies each for single line code blocks.

Jump in the discussion.

No email address required.

>Every smart dev I know did this 2yrs ago when the state of this NPM shit came to light

Have you only been working for 2 years because lock files in node land have been around for 6 years.

Even before then the secure way was always either a custom registry or checking node modules into source control.

Jump in the discussion.

No email address required.

I’m not talking about lock files, I mean locking down version numbers.

A lock file wouldn’t do anything to help here anyway?

And I’ve been doing it for over a decade and I’ve seen so many open source projects that still use tildes for every package version number. This is a behavioral change not a tech change.

Jump in the discussion.

No email address required.

I am a wannabe codecel so I am genuinely curious: is a locked npm version when you don't use tilde or caret range?

Jump in the discussion.

No email address required.

Yep

Jump in the discussion.

No email address required.

Lol javascript development is such a joke

Jump in the discussion.

No email address required.

how does a lock file help in this case r-slur

Jump in the discussion.

No email address required.

With a fixed version number you’re not going to download these exploits unless you explicitly change the version number in your package.json.

Otherwise any dev on your team who does npm install is at risk of installing any new minor package version update

Jump in the discussion.

No email address required.

these are forks not the original packages

Jump in the discussion.

No email address required.

but open source means its harder to introduce malicious code beacuse of all the people looking at it :marsoyhype:

Jump in the discussion.

No email address required.

The commits aren’t getting slipped into OSS projects, he’s creating ersatz duplicates of the OSS projects and adding malware on top. Complete morons then download the wrong copies (possibly) and get pwned. The actual OSS software is unaffected.

Jump in the discussion.

No email address required.

>he thinks i actually read the article

Jump in the discussion.

No email address required.

:#gigachad3:

Jump in the discussion.

No email address required.

he’s creating ersatz duplicates of the OSS projects and adding malware on top

I can't count how many times I've needed to tell a company that their private npm Repos still need to be reserved on npm.

Jump in the discussion.

No email address required.

This why I literally only use proprietary closed source binaries. I pay for it, yeah, but that makes it higher quality.

*Sent from my iPhone 12S

Jump in the discussion.

No email address required.

It should be harder for anyone who isn't immediately clicking yes on every single update as soon as it comes out at least.

Jump in the discussion.

No email address required.

:#marseysoypoint:

Jump in the discussion.

No email address required.

This is why we don't install random packages off the internet!

entire JS ecosystem in shambles

Jump in the discussion.

No email address required.

When the teacher finds out the entire class copied one kid's homework because they all have the same wrong answers

Jump in the discussion.

No email address required.

:marseypregunta:

Did they create infected copies of projects or add the link to the real projects?

Jump in the discussion.

No email address required.

Seems like a real Github user is committing the code as a post-install script, then the releases somehow get published as new versions:

https://github.com/operatino/ronin/commit/800aecaf499001a95dd4ec73889020430e09dce4

Latest version is 3.11 https://www.npmjs.com/package/ronin

idk how this could happen, is this a Github exploit or dev accounts hijacked? My guess is Github exploit:

Some of these repo histories include commits from the original author, but the commit is not GPG verified:

Jump in the discussion.

No email address required.

I think there is a known exploit in GitHub where you can push changes to repositories you don’t own.

Jump in the discussion.

No email address required.

is youtube-dl compromised?

Jump in the discussion.

No email address required.

>he still uses youtube-dl instead of yt-dlp

Jump in the discussion.

No email address required.

>he uses yt-dlp instead of a handheld camcorder

Jump in the discussion.

No email address required.

>he wants to download a yt video

>he just downloads without being neurodivergent with details

i've an old version saved which i use like once in 2 months. if it stops working, I'll get yt-dlp thanks

Jump in the discussion.

No email address required.

what's the advantage

Jump in the discussion.

No email address required.

:#marseyblowkiss:

Snapshots:

Jump in the discussion.

No email address required.

you are all being r-slurs, i checked the real orange site and even I can fricking read that this is a nothing burger and false

Jump in the discussion.

No email address required.

Currently over 35k repositories are infected

crypto, golang,

Fricking good.

Jump in the discussion.

No email address required.

Who is merging these PRs from randos without reading them? In my book that aint malicious, you literally asked for this

Jump in the discussion.

No email address required.

Link copied to clipboard
Action successful!
Error, please refresh the page and try again.