Malicious npm Packages Caught Installing Remote Access Trojans (zdnet.com) 20
The security team behind the "npm" repository for JavaScript libraries removed two npm packages this Monday for containing malicious code that installed a remote access trojan (RAT) on the computers of developers working on JavaScript projects. From a report: The name of the two packages was jdb.js and db-json.js., and both were created by the same author and described themselves as tools to help developers work with JSON files typically generated by database applications. Both packages were uploaded on the npm package registry last week and were downloaded more than 100 times before their malicious behavior was detected by Sonatype, a company that scans package repositories on a regular basis. According to Sonatype's Ax Sharma, the two packages contained a malicious script that executed after web developers imported and installed any of the two malicious libraries. The post-install script performed basic reconnaissance of the infected host and then attempted to download and run a file named patch.exe that later installed njRAT, also known as Bladabindi, a very popular remote access trojan that has been used in espionage and data theft operations since 2015.
How many times will this happen? (Score:2)
I get that npm wants to be accessible and easy to add code to, but they have just way too many of these incidents to excuse. Either make this kind of screening much more reliable, and mandatory before any new module shows up in search results, or require uploaders to verify their identity before accepting uploads. Not every country has something like Section 230 that lets people avoid responsibility for malicious content that they disseminate.
Re:How many times will this happen? (Score:5, Insightful)
At the same pace until Javascript and its community matures. Or better yet, gets replaced.
NPM is one part package manager (for very broad/vague definitions of "package"), one part code snippet landfill, and one part language prosthetic, all because JS needs it to be. All the JS infrastructure was developed haphazardly by inexperienced developers with a "clean room" mentality who insist on solving all related problems anew to prove JS is on par with better languages. As with every other language, every bit of infrastructure is a reflection of the language and its community.
Re: (Score:3)
The problem isn't with javascript, it's with the mentality that surrounds the usage of npm.
Javascript does not require npm to be useful.
Re: (Score:2)
As demonstrated by Deno and browsers, sure.
Node.js does, for the most part, require npm. Node.js/npm won't be going away anytime soon.
Re: (Score:2)
Javascript does not require npm to be useful.
Just try developing an Angular application without it.
It can be done -- but why.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The first time, it's a KLUDGE! The second, a trick. Later, it's a well-established technique! -- Mike Broido, Intermetrics
post-install (Score:2)
And maybe one day we will have a package manager that can install files for you with only having access to save files, not run arbitrary commands on your shell.
Re: (Score:3)
For the sake of argument, let's say this happens. Then what? The code will then be executed on first-run instead. This effectively only slightly delays the security boundary by a few moments.
Re: (Score:2)
Well, of course, the packages you are installing would be run in some kind of isolated virtual machine.
Re: (Score:2)
I mean, the problem is the packages are designed to execute arbitrary code libraries. Installing isn't the issue, right, it's what the code they install does.
Re: (Score:2)
This is a big consideration in the module system for Go. For example, you can include C code that is linked with a Go module or executable, and you can control the compilation with comments like this:
But only whitelisted compiler and linker flags are accepted through that mechanism, to prevent any arbitrary code from running during the build step. Similarly, a //go:generate comment can indicate how to generate source files -- but those commands are never run automatically;
patch.exe? (Score:3)
From the sound of it it appears that once again my OS of choice won't be supported. And not even WINE installed.
Re: (Score:3)
well if you want to run the Linux version of the trojan you need to compile it yourself first, of course.
Meh (Score:2)
Meh, npm has inflated/inaccurate download numbers at best.
Of those 100 downloads, I imagine 99 of them were npm mirrors, not true users.
Re: Meh (Score:2)
And this is why (Score:2)
Every time Visual Studio asks me to install npm I think "that would be nice" and then remember the last news story like this one and don't. Yes it would be nice but I always find a way to do without.
I'm not an expert in Javascript (Score:2)
And the author was ... (Score:2)
Hmm? And has he been shot?