6 ms·

Given the recent npm attacks, is it even safe to develop using npm. Whenever I start a react project, it downloads hundreds of additional packages which I have

Given the recent npm attacks, is it even safe to develop using npm. Whenever I start a react project, it downloads hundreds of additional packages which I have mo idea about what they do. As a developer who has learnt programming as a hobby, is it better to stick to some other safe ways to develop front end like thyme leaf or plain js or something else. When I build backend in flask or Django, I specifically type the python packages that I need. But front end development seems like a Pandora box of vulnerabilities

nektro 11mo ago
this is one of the less talked about benefits of using bun
- Defletter 11mo ago
  How does Bun avoid this? Or is it more that Bun provides things that you'd otherwise need a dependency for (eg: websockets)?
  - lioeters 11mo ago
    From a link mentioned elsewhere in the thread: > Unlike other npm clients, Bun does not execute arbitrary lifecycle scripts for installed dependencies, such as `postinstall` and `node-gyp` builds. These scripts represent a potential security risk, as they can execute arbitrary code on your machine. https://bun.com/docs/guides/install/trusted https://bun.com/docs/guides/install/trusted I've also found the Bun standard library is a nice curated set of features that reduces dependencies.
    - Defletter 11mo ago
      Hmmm, it still has a pretty extensive default list of permitted npm packages, which wouldn't necessarily be a problem if there were a way to disable it, but I can't seem to find it.
  - nektro 11mo ago
    the latter is what i was getting at yeah. updated list of standard library-esque functions implemented in native code so the need to reach to npm for a dependency happens far less often.
fragmede 11mo ago
Just a heads up that Pypi isn't immune from the same attack, with "Pypi supply chain attack" into Google revealing a (much smaller) number of packages that turned out to be malware. Some were not misspellings either, with one being a legitimate package that got hacked via GitHub Actions and a malicious payload added to the otherwise legitimate package.
- graemep 11mo ago
  Definitely, and you should be aware of the risk and think about and assess your dependencies. Having a large standard library does reduce the number of dependencies, and you can go a long way using only well known dependencies.
- tjpnz 11mo ago
  No language ecosystem is but NPM/Node still encourages this idea (borrowed elsewhere and interpreted poorly) that everything must be its own tiny package and that it's acceptable to author libraries consisting of thousands of transitive dependencies from potentially dubious sources. Just this week I saw one (unmaintained dependency of a popular package) which consisted of a list of a dozen SQL operators. Anywhere else you would just write the damn code, maybe add a comment that these are the SQL-92 operators and be done with it literally forever. But in Node land that would be viewed as an antipattern which only another package can fix. It's a security and maintenance nightmare that can only be explained by laziness and outright stupidity.
  - silverwind 11mo ago
    It's a misconception that NPM or Node encourage this, because they don't. There are a few package authors that are doing it that way (some even paid by download count), but that's their opinion. Recently there is a trend towards minimal-dependency packages and I would certainly recommend auditing every package for its dependencies before using it.
socalgal2 11mo ago
It's no different anywhere else. I just downloaded jj (rust), it installed 470+ packages When I downloaded wan2gp (python) it installed it install 211 packages.
- BrouteMinou 11mo ago
  M'yea, good luck finding such occurrence with NuGet or Maven for example. I would rephrase your "anywhere else". NPM is a terrible ecosystem, and trying to defend its current state is a lost cause. The energy should be focused on how to fix that ecosystem instead of playing dumb telling people "it's all ok, look at other, also poorly designed, systems". Don't forget that Rust's Cargo got heavily inspired by NPM, which is not something to brag about.[0] > "Rust has absolutely stunning dependency management," one engineer enthused, noting that Rust's strategy took inspiration from npm's. [0]https://rust-lang.org/static/pdfs/Rust-npm-Whitepaper.pdf https://rust-lang.org/static/pdfs/Rust-npm-Whitepaper.pdf
  - socalgal2 11mo ago
    [dead]
- scuff3d 11mo ago
  One of the biggest things that pushes me away from Rust is the reliance on micro dependencies. It's a terrible model.
  - codedokode 11mo ago
    What's wrong with micro dependencies? Isn't it better to download only the code you need? Also it makes refactoring easier, and enforces better architecture.
    - jgtrosh 11mo ago
      Is this bait? The whole context is malicious software being installed en masse via NPM micro dependencies.
deleted 11mo ago
[deleted]
silverwind 11mo ago
All package ecosystems that allow unvetted code being published are affected, it just happens that npm is by far the most popular one, so it gets all the news.
maxloh 11mo ago
I come from a JavaScript background, and I've got to admit that the ecosystem is designed in a way that is really prone to attack. It is like the xz incident, except that each dependency you pull is maintained by a random guy on the internet. You have to trust every one of them to be genuine and that they won't fall into any social engineering attacks.
azangru 11mo ago
> As a developer who has learnt programming as a hobby, is it better to stick to some other safe ways to develop front end like thyme leaf or plain js or something else. Oh, absolutely, there is no question about it. Fewer dependencies means less headache; and if you can get the number of your dependencies to zero, then you have won the internet.
- johnisgood 11mo ago
  Sounds like... C.
TZubiri 11mo ago
Here's my black pill: Node in general is not safe. The blurring of the client-server lines is a security risk. Very easy to expose the wrong thing; the language appeals to people who know 1 language (which correlates with lack of experience). In my personal experience node projects developed under my supervision had very basic client-server boundary vulns 66.67% of the time. Empirically it's not great.

nektro 11mo ago

this is one of the less talked about benefits of using bun

Defletter 11mo ago
How does Bun avoid this? Or is it more that Bun provides things that you'd otherwise need a dependency for (eg: websockets)?
- lioeters 11mo ago
  From a link mentioned elsewhere in the thread: > Unlike other npm clients, Bun does not execute arbitrary lifecycle scripts for installed dependencies, such as `postinstall` and `node-gyp` builds. These scripts represent a potential security risk, as they can execute arbitrary code on your machine. https://bun.com/docs/guides/install/trusted https://bun.com/docs/guides/install/trusted I've also found the Bun standard library is a nice curated set of features that reduces dependencies.
  - Defletter 11mo ago
    Hmmm, it still has a pretty extensive default list of permitted npm packages, which wouldn't necessarily be a problem if there were a way to disable it, but I can't seem to find it.
- nektro 11mo ago
  the latter is what i was getting at yeah. updated list of standard library-esque functions implemented in native code so the need to reach to npm for a dependency happens far less often.

fragmede 11mo ago

Just a heads up that Pypi isn't immune from the same attack, with "Pypi supply chain attack" into Google revealing a (much smaller) number of packages that turned out to be malware. Some were not misspellings either, with one being a legitimate package that got hacked via GitHub Actions and a malicious payload added to the otherwise legitimate package.

graemep 11mo ago
Definitely, and you should be aware of the risk and think about and assess your dependencies. Having a large standard library does reduce the number of dependencies, and you can go a long way using only well known dependencies.
tjpnz 11mo ago
No language ecosystem is but NPM/Node still encourages this idea (borrowed elsewhere and interpreted poorly) that everything must be its own tiny package and that it's acceptable to author libraries consisting of thousands of transitive dependencies from potentially dubious sources. Just this week I saw one (unmaintained dependency of a popular package) which consisted of a list of a dozen SQL operators. Anywhere else you would just write the damn code, maybe add a comment that these are the SQL-92 operators and be done with it literally forever. But in Node land that would be viewed as an antipattern which only another package can fix. It's a security and maintenance nightmare that can only be explained by laziness and outright stupidity.
- silverwind 11mo ago
  It's a misconception that NPM or Node encourage this, because they don't. There are a few package authors that are doing it that way (some even paid by download count), but that's their opinion. Recently there is a trend towards minimal-dependency packages and I would certainly recommend auditing every package for its dependencies before using it.

socalgal2 11mo ago

It's no different anywhere else. I just downloaded jj (rust), it installed 470+ packages When I downloaded wan2gp (python) it installed it install 211 packages.

BrouteMinou 11mo ago
M'yea, good luck finding such occurrence with NuGet or Maven for example. I would rephrase your "anywhere else". NPM is a terrible ecosystem, and trying to defend its current state is a lost cause. The energy should be focused on how to fix that ecosystem instead of playing dumb telling people "it's all ok, look at other, also poorly designed, systems". Don't forget that Rust's Cargo got heavily inspired by NPM, which is not something to brag about.[0] > "Rust has absolutely stunning dependency management," one engineer enthused, noting that Rust's strategy took inspiration from npm's. [0]https://rust-lang.org/static/pdfs/Rust-npm-Whitepaper.pdf https://rust-lang.org/static/pdfs/Rust-npm-Whitepaper.pdf
- socalgal2 11mo ago
  [dead]
scuff3d 11mo ago
One of the biggest things that pushes me away from Rust is the reliance on micro dependencies. It's a terrible model.
- codedokode 11mo ago
  What's wrong with micro dependencies? Isn't it better to download only the code you need? Also it makes refactoring easier, and enforces better architecture.
  - jgtrosh 11mo ago
    Is this bait? The whole context is malicious software being installed en masse via NPM micro dependencies.

deleted 11mo ago

[deleted]

silverwind 11mo ago

All package ecosystems that allow unvetted code being published are affected, it just happens that npm is by far the most popular one, so it gets all the news.

maxloh 11mo ago

I come from a JavaScript background, and I've got to admit that the ecosystem is designed in a way that is really prone to attack. It is like the xz incident, except that each dependency you pull is maintained by a random guy on the internet. You have to trust every one of them to be genuine and that they won't fall into any social engineering attacks.

azangru 11mo ago

> As a developer who has learnt programming as a hobby, is it better to stick to some other safe ways to develop front end like thyme leaf or plain js or something else. Oh, absolutely, there is no question about it. Fewer dependencies means less headache; and if you can get the number of your dependencies to zero, then you have won the internet.

johnisgood 11mo ago
Sounds like... C.

TZubiri 11mo ago

Here's my black pill: Node in general is not safe. The blurring of the client-server lines is a security risk. Very easy to expose the wrong thing; the language appeals to people who know 1 language (which correlates with lack of experience). In my personal experience node projects developed under my supervision had very basic client-server boundary vulns 66.67% of the time. Empirically it's not great.