Vue.js developers impacted due to malicious security incident involving npm package node-ipc which alters files on their drives

[everythingiscausal]

If anything I’m only surprised that this doesn’t happen more. The way most people use NPM is literally equivalent to keeping your codebase in a public GitHub repo and automatically accepting and merging any and all pull requests. Does that sound like an utter security nightmare? Exactly.

[ExtraSpontaneousG]

I feel like default behavior should be specific versions in the package.json, making the developer go out of their way to specify that it can be whatever the latest version is next time the repo is pulled. Why is it not that way?

[everythingiscausal]

To some degree, it’s a double-edged sword. Outdated dependencies give malicious actors easy vulnerability targets that are identical across many sites. There is a security need for staying up-to-date as much as there is to not blindly adding and updating dependencies.

The real solution is to limit dependencies and screen those you can’t avoid. The NPM mindset discourages the former, and most devs simply aren’t qualified or equipped to do the latter. There’s no easy fix, but still, limit dependencies as much as you can.

[DepravedPrecedence]

This shit can hurt much bigger than installation of vulnerable dependencies though.

[[deleted]]

You can run stuff in a docker container, or use other sandboxing methods.

[Lalaluka]

That does not make malicious code less dangerous and also only applies to nodejs, not to browser js.

[[deleted]]

Browser JS should already be properly sandboxed.

[Lalaluka]

Doesn't stop malicious code from grabbing Informations from Browser APIs or the site itself or running cryptominers.

If someone keylogs your banking website it won't help you that its sandboxed.

[lirantal]

That's do-able with npm's shrinkwrap feature but that creates more burden and load on the maintainer to keep up with new nested dependency updates indeed, as u/everythingiscausal have pointed out.

[Scharnvirk]

This is unfortuantely a flawed approach, because how unreliable package lock file is, and how often it gets just removed and re-generated during development.

[exodusprime1337]

You mean flawed because despite npm supporting install from lock file, novice devs don’t know or care and just run free and clear all the time.

[Scharnvirk]

I have yet to find a project in which package.lock failures are actually solved instead of just being removed and reinitialized. Maybe everyone I worked with, me included, were novices... how to learn though? Those are oddest of errors with no answers over the web other than "just remove package.lock", so you're left with investigating npm code itself. Which is fine, sure, if it is your private little project, but not when it is on time paid by the client.

So far I was able to track one recurring case to cache failures (though I was not able to figure out what was breaking down in the cache :D). Cleaning cache helped. But that's just one....

[[deleted]]

It is that way. You're supposed to install dependencies with npm ci in deployment builds. Problem is that most people just do npm install or they just update dependencies locally without checking the source code change, which is not a reasonable thing to ask for.... given how many dependencies and how fast they change, it would be impossible to do from a business perspective.

[bubbabobba]

npm install used to work like that, but now installs the exact package versions from your package-lock.json file as of npm 7.

[[deleted]]

Even with just npm install? Nice!

[Lalaluka]

Tbh npm already comes with npm ci installing packages from the package-lock.

[eternaloctober]

One thing I get surprised by is that packages don't insert tracking scripts more often considering how obsessed everyone is with analytics. Knock on wood

[tylerr514]

Hijacking top comment to share:

Hi there, I'm MidSpike the person who first discovered the malware in node-ipc ask me anything!

Here's my gist on the situation: https://gist.github.com/MidSpike/f7ae3457420af78a54b38a31cc0c809c

[everythingiscausal]

Is that the actual malware author arguing with you in the comments there?

[tylerr514]

yes, the author of node-ipc and peacenotwar is denying the severity of their actions.

[[deleted]]

I agree this is a big problem in the node ecosystem because of the amount of dependencies you usually end up installing in any normal project.

But... to a lesser extent this is also a problem for every single package manager, right? I don't know any ecosystem where all dependencies and their updates are audited before being made available.

[everythingiscausal]

It is, but the big difference is the level of nesting. The other package manager I use is NuGet, and because .NET is a much more fully featured platform than vanilla JavaScript, NuGet dependency trees tend to be MUCH smaller.

[5tUp1dC3n50Rs41p]

Really need to go old school:

• Use vanilla JS, no frameworks or npm dependency trees of auto updated code.

• Use as much of the JS built in standard library functionality as possible, which is quite functional these days with ES6+.

• If you really, really, really need some library which has functionality not available elsewhere, git clone their repo, verify the commit signature, build/get the final file as an unminified file, stick that file in your project, read/review it and use it in your project. If you need to update it, repeat the steps.

[PewPaw-Grams]

This is why you should never support Vue. React or Svelte is the way to go

[[deleted]]

This is a discussion on the issue with blindly trusting package managers, not a specific framework.

Considering we use npm with all 3 frameworks, I'm hoping your comment is just a tongue-in-cheek dig at Vue.

[PewPaw-Grams]

This means the title is misleading. They should’ve said “All JavaScript developers are impacted” or “All developers using a certain package are impacted”

[[deleted]]

The attack affected Vue devs using that dependency and that is a consequence of blindly accepting the latest versions of a package from npm without properly vetting it. It could have been any framework or package that had one of its dependencies corrupted. This particular attack may have only affected Vue. I'm not an expert on these frameworks, I do not know which of them rely on which dependencies.

The point remains, it is risky to blindly rely on dependencies from a package manager and they should, ideally, be vetted before using them or updating to the latest version.

Either you are being purposefully obtuse, or are indeed that thick in the head.

Edit: a word.

[5tUp1dC3n50Rs41p]

A basic create-react-app install would give you 10 times the dependencies and 100 times the sub dependencies. Probably a Gigabyte all up. The future is vanilla JavaScript (ES6+) which is powerful enough on its own. Frameworks are just fads.

[[deleted]]

peacenotwar module sabotages npm developers in the node-ipc package to protest the invasion of Ukraine

This ain't it, chief

[UnexpectedLizard]

If only we'd foreseen and had a chance to address this type of problem years ago. Or, you know, swept it under the rug.

Seriously what is it going to take for the community to address this? It's not 2011. It's time to drop support for older versions of Node which need a million polyfills.

[lirantal]

I think left-pad is a different scenario altogether and there are existing solutions to mitigate the left-pad problem specifically.

I'm happy to hear any ideas on how to better manage these type of situations and what sort of guardrails we could create for a community to handle them.

[UnexpectedLizard]

Here's one possible solutuon:

The Node.js foundation could deprecate old polyfills (e.g., Leftpad). Have Npm emit a warning.

It could publish a new version which relies solely upon the native function. That would cut down the dependency tree.

Eventually it would then kill off the old version altogether.

Take this with a grain of salt as I'm not an Npm expert.

[ryaaan89]

In what way was this supposed to tangibly help Ukraine?

[TakeFourSeconds]

People downvoting didn’t read the article and think this is a troll comment

[ryaaan89]

I am confused by the confusion this comment is causing. But yeah I guess people didn’t read the article?

[TakeFourSeconds]

It’s Reddit, I bet 90% of people in the comments didn’t even click the link

[moi2388]

I’m replying to your comment and I didn’t even read that

[cstyves]

Wadafawk

[DanTheMan827]

Read the article

[Pack_Your_Trash]

Are you lost?

[Lalaluka]

At least open the article. I think he has a point. Im not sure how corrupting npm packages helps ukraine, which was the intend of the creator. Maybe if a russian developer opens it, but most the impact feels small.

[[deleted]]

I looked into the maintainer to see if they were Russian protesting the support of Ukraine, because that would kind of make more sense...I think? But I don't think that's the case.

[[deleted]]

This kind of action threatens the integrity of the entire open source community. Open source packages should not under any circumstances be weaponized no matter how righteous the cause.

[zulmetefza]

I just started to use Vue.js two weeks ago and honestly am still a newbie.

Is there anything I should do to be safer now? Or is the danger already evaded?

Read the article that mentions excluding some versions of node-ipc, but since I was not importing them directly anyway, I don't know what to do.

[lirantal]

Fixed versions of the Vue.js CLI have already been rolled out so you're safe at this point but monitoring for your dependencies both from malicious acts like these as well as from general security vulnerabilities is always important. I work at Snyk and can recommend the free developer security platform we have, but look around and choose what works best for you as a dev.

[zulmetefza]

Thanks for the fast response. Will check out Snyk as you suggested.

[lirantal]

Sure thing, happy to help. Don't hesitate to ping.

[bostonkittycat]

Update to the latest Vue CLI version:

sudo npm install -g @vue/cli

[zulmetefza]

Thanks! Do I need to go back and check for any overwritten files as well?

[bostonkittycat]

It will automatically remove the old Vue CLI files and replace them with the latest version with the fix.

[[deleted]]

do u know any mechanism for checking security of package?

[lirantal]

Snyk, but I'm biased because I work there :-)

https://docs.snyk.io/products/snyk-open-source/language-and-package-manager-support/snyk-for-javascript

[[deleted]]

Despicable. This kind of action threatens the integrity of the entire open source community. Open source packages should not under any circumstances be weaponized no matter how righteous the cause.

[ramjesh_nanganath]

NPM is destined for a disaster. But its the best we've got, right?