7 ms·
Periodic reminder to disable npm install scripts. npm config set ignore-scripts true [--global] It's easy to do both at project level and globally, and th
by inbx0 1y ago
Periodic reminder to disable npm install scripts.
npm config set ignore-scripts true [--global]
It's easy to do both at project level and globally, and these days there are quite few legit packages that don't work without them. For those that don't, you can create a separate installation script to your project that cds into that folder and runs their install-script.
I know this isn't a silver bullet solution to supply chain attakcs, but, so far it has been effective against many attacks through npm.
https://docs.npmjs.com/cli/v8/commands/npm-config https://docs.npmjs.com/cli/v8/commands/npm-config
- tiagod 1y agoOr use pnpm. The latest versions have all dependency lifecycle scripts ignored by default. You must whitelist each package.
- chrisweekly 1y agopnpm is not only more secure, it's also faster, more efficient wrt disk usage, and more deterministic by design.
- norskeld 1y agoIt also has catalogs feature for defining versions or version ranges as reusable constants that you can reference in workspace packages. It was almost the only reason (besides speed) I switched a year ago from npm and never looked back.
- mirekrusin 1y agoworkspace protocol in monorepo is also great, we're using it a lot.
- dvfjsdhgfv 1y agoOK so it seems too good now, what are the downsides?
- c-hendricks 1y agoIf you relied on hoisting of transitive dependencies, you'll now have to declare that fact in a project's .npmrc Small price to pay for all the advantages already listed.
- no_wizard 1y agoThey’re moving all that to the pnpm-workspace.yaml file now
- nawgz 1y ago‘pnpm’ is great, swapped to it a year ago after yarn 1->4 looked like a new project every version and npm had an insane dependency resolution issue for platform specific packages pnpm had good docs and was easy to put in place. Recommend
- TheRoque 1y agoPersonally, I didn't find a way to create one docker image for each of my project (in a pnpm monorepo) in an efficient way
- no_wizard 1y agoThat’s not really a pnpm problem on the face of it
- mirekrusin 1y agoDownside is that you have to add "p" in front, ie. instead of "npm" you have to type "pnpm". That's all that I'm aware of.
- Nathanba 1y agoA few years ago it didn't work in all cases when npm did. It made me stop using it because I didn't want to constantly check with two tools. The speed boost is nice but I don't need to npm install that often.
- jim201 1y agoThis is the way. It’s a pain to manually disable the checks, but certainly better than becoming victim to an attack like this.
- trw55 1y agoSame for bun, which I find faster than pnpm
- silverwind 1y agoBun still executes the scripts of a certain hardcoded list of 500 packages, it's not exactly the same.
- halflife 1y agoThis sucks for libraries that download native binaries in their install script. There are quite a few.
- homebrewer 1y agoI also use bubblewrap to isolate npm/pnpm/yarn (and everything started by them) from the rest of the system. Let's say all your source code resides in ~/code; put this somewhere in the beginning of your $PATH and name it `npm`; create symlinks/hardlinks to it for other package managers: #!/usr/bin/bash bin=$(basename "$0") exec bwrap \ --bind ~/.cache/nodejs ~/.cache \ --bind ~/code ~/code \ --dev /dev \ --die-with-parent \ --disable-userns \ --new-session \ --proc /proc \ --ro-bind /etc/ca-certificates /etc/ca-certificates \ --ro-bind /etc/resolv.conf /etc/resolv.conf \ --ro-bind /etc/ssl /etc/ssl \ --ro-bind /usr /usr \ --setenv PATH /usr/bin \ --share-net \ --symlink /tmp /var/tmp \ --symlink /usr/bin /bin \ --symlink /usr/bin /sbin \ --symlink /usr/lib /lib \ --symlink /usr/lib /lib64 \ --tmpfs /tmp \ --unshare-all \ --unshare-user \ "/usr/bin/$bin" "$@" The package manager started through this script won't have access to anything but ~/code + read-only access to system libraries: bash-5.3$ ls -a ~ . .. .cache code bubblewrap is quite well tested and reliable, it's used by Steam and (IIRC) flatpak.
- shermantanktop 1y agoThis is trading one distribution problem (npx) for another (bubblewrap). I think it’s a reasonable trade, but there’s no free lunch.
- homebrewer 1y agoNot sure what this means. bubblewrap is as free as it gets, it's just a thin wrapper around the same kernel mechanisms used for containers, except that it uses your existing filesystems instead of creating a separate "chroot" from an OCI image (or something like it). The only thing it does is hiding most of your system from the stuff that runs under it, whitelisting specific paths, and optionally making them readonly. It can be used to run npx, or anything else really — just shove move symblinks into the beginning of your $PATH, each referencing the script above. Run any of them and it's automatically restricted from accessing e.g. your ~/.ssh https://wiki.archlinux.org/title/Bubblewrap https://wiki.archlinux.org/title/Bubblewrap
- 1y ago
- eitau_1 1y agoWhy the same advice doesn't apply to `setup.py` or `build.rs`? Is it because npm is (ab)used for software distribution (eg. see sibling comment: https://news.ycombinator.com/item?id=45041292 https://news.ycombinator.com/item?id=45041292) instead of being used only for managing library-dependencies?
- ivape 1y agoIt should apply for anything. Truth be told the process of learning programming is so arduous at times that you basically just copy and paste and run fucking anything in terminal to get a project setup or fixed. Go down the rabbit hole of just installing LLM software and you’ll find yourself in quite a copy and paste frenzy. We got used to this GitHub shit of setting up every process of an install script in this way, so I’m surprised it’s not happening constantly.
- username223 1y agoIt should, and also to Makefile.PL, etc. These systems were created at a time when you were dealing with a handful of dependencies, and software development was a friendlier place. Now you're dealing with hundreds of recursive dependencies, all of which you should assume may become hostile at any time. If you neither audit your dependencies, nor have the ability to sue them for damages, you're in a precarious position.
- ifwinterco 1y agoFor simple python libraries setup.py has been discouraged for a long time in favour of pyproject.toml for exactly this reason
- arminiusreturns 1y agoAs a linux admin, I refuse to install npm or anything that requires it as a dep. It's been bad since the start. At least some people are starting to see it.
- azangru 1y ago> As a linux admin, I refuse to install npm or anything that requires it as a dep. It's been bad since the start. As a front-end web developer, I need a node package manager; and npm comes bundled with node.
- arminiusreturns 1y agoHow in the world did we survive before node?
- sheerun 1y agoSecondary reminder that it means nothing as soon as you run any of scripts or binaries
- andix 1y agoI guess this won't help with something like nx. It's a CLI tool that is supposed to be executed inside the source code repo, in CI jobs or on developer pcs.
- inbx0 1y agoAccording to the description in advisory, this attack was in a postinstall script. So it would've helped in this case with nx. Even if you ran the tool, this particular attack wouldn't have been triggered if you had install scripts ignored.
- deleted 1y ago[deleted]
- herpdyderp 1y agoUnfortunately this also blocks your own life cycle scripts.
- ashishb 1y agoI run all npm based tools inside Docker with no access beyond the current directory. https://ashishb.net/programming/run-tools-inside-docker/ https://ashishb.net/programming/run-tools-inside-docker/ It does reduce the attach surface drastically.
- oulipo2 1y agoDoes it work the same for pnpm ?
- peacebeard 1y agoLooks like pnpm 10 does not run lifecycle scripts of dependencies unless they are listed in ‘onlyBuiltDependencies’. Source: https://pnpm.io/settings#ignoredepscripts https://pnpm.io/settings#ignoredepscripts
- no_wizard 1y agoPnpm natively lets you selectively enable it on a package basis
- sieabahlpark 1y ago[dead]
- antihero 1y agoI wonder how many other packages are going to be compromised due to this also. Like a network effect.
- johnisgood 1y agoAt this point why not just avoid npm (and friends) like the plague? Genuinely curious.
- ifwinterco 1y agoI work for a company that needs to ship software so my salary can get paid
- johnisgood 1y agoCan't you guys replace the most vulnerable parts with something better? I have been experimenting with Go + Fyne, it is pretty neat, all things considered.
- deleted 1y ago[deleted]
- dns_snek 1y agoWhenever I read this well-meaning advice I have to ask: Do you actually read hundreds of thousands of lines of code (or more) that NPM installed? Because the workflow for 99.99% of developers is something resembling: 1. git clone 2. npm install (which pulls in a malicious dependency but disabling post-install scripts saved you for now!) 3. npm run (executing your malicious dependency, you're now infected) The only way this advice helps you is if you also insert "audit the entirety of node_modules" in between steps 2 and 3 which nobody does.
- IshKebab 1y agoYeah I guess it probably helps you specifically, because most malware is going to do the lazy thing and use install scripts. But it doesn't help everyone in general because if e.g. NPM disabled those scripts entirely (or made them opt-in) then the malware authors would just put their malware into the `npm run` as you say.
- dns_snek 1y agoIndeed it may save you in case the malware is being particularly lazy but I think it may do more harm than good by giving people a false sense of security and it can also break packages that use post-install scrips for legitimate reasons. For anyone who actually cares about supply chain attacks, the minimum you should be doing is running untrusted code in some sort of a sandbox that doesn't have access to important credentials like SSH keys, like a dev container of some sort. You would still need to audit the code otherwise you might ship a backdoor to production but it would at least protect you against a developer machine compromise... unless you get particularly unlucky and it also leverages a container escape 0-day, but that's secure enough for me personally.