«GITLAB DISCOVERS WIDESPREAD NPM SUPPLY CHAIN ATTACK»

🟠 [https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/]

Это был, конечно, тяжёлый год для «npm», но этот "призыв Шаи-Хулуда" – одна из самых внезапных и отчасти красивых отссылок к «Dune».

Тот случай, когда смотришь на вирусную гадость и думаешь не "фу, какая вирусная гадость", а "ля, а как прикольно придумано".

#Sha1Hulud #Dune

Security hot take: When a build tool (NPM/Cargo/Maven/etc) tries to download a known compromised version of a package, the repository should send the build a status code that breaks the build on the client side.

Business process interruptions should not be prioritised ahead of integrity and confidentiality.

#security #sha1hulud

Well, despite #GitHub & #npm making a big push for mandatory #2FA, the #ShaiHulud / #Sha1Hulud attacks happened anyway.

Grand. #MFA has wasted my time and put me forevermore at risk of being locked out of my own account, and it's all for nothing. 🤬

Could the #cybersecurity #infosec people please come up with an authentication scheme for npm that's actually secure? Your users are programmers and you're running arbitrary code on their boxes. You have a LOT of latitude here. Use your imagination.

so with #sha1hulud v2 around, there's never been a worse time to experiment with #typescript. (which i'm doing now. timing.)

me: "how do i check *all* the dependencies? not just the top level, but recursively through their dependencies as well?"
google results: `npm view ls` will do that for your installed packages :)

...yeah but guess when sha1hulud detonates? in a pre- or post- install script.

so i made this. https://github.com/AdamRGrey/npm-dependencies-flatten
hopefully npm doesn't mind being pinged that much. (and then i manually cross reference with a list of known infected packages; here's one: https://jfrog.com/blog/shai-hulud-npm-supply-chain-attack-new-compromised-packages-detected/ )