SAN FRANCISCO, CA - In the wake of a devastating supply chain attack in the npm registry that left millions of enterprise applications compromised and billions of user records exposed, developers across the JavaScript ecosystem expressed deep sorrow today, lamenting that such a crisis was completely unavoidable. “It’s a shame, but what can you do? This is just the price of building modern web apps,” said Senior Frontend Engineer Mark Vance, echoing the sentiments of a community that completely relies on a 40-level-deep nested tree of unvetted packages maintained by pseudonymous strangers to capitalize a single string. “There’s absolutely no way to foresee or prevent someone from taking over a long-abandoned utility package and injecting a crypto-miner into every production build in the world. It’s just an act of nature.”
  • TheTechnician27@lemmy.worldEnglish
    2·
    17 minutes ago

    Hilarious idea brought down by the AI slop thumbnail. The vulneráéilíties on that screen sure look OOTΓKAL.

  • HiddenLayer555@lemmy.mlEnglish
    3·
    45 minutes ago

    Interestingly, developers in ecosystems like Go, Rust, and those utilizing native Web APIs—where robust standard libraries drastically reduce reliance on third-party code and strict cryptographic verification is built into the core toolchain

    Does NPM really not do cryptographic verification or is this part of the joke? I always assumed the attacks were due to a compromised key or something, but this is implying you can just push whatever you want to an NPM package if you have the author’s login?

    • moonpiedumplings@programming.devEnglish
      21·
      16 minutes ago

      Rust

      Rust is doing pretty poorly right now.

      among the 999 most popular crates on crates.io, around 17% contained code that do not match their code repository.

      https://kerkour.com/rust-supply-chain-nightmare

      Unlike javascript, where at least it is an interpreted language people can audit, you would have to reverse engineer these binaries to figure out what they do.

      push whatever you want to an NPM package if you have the author’s login

      This is how all language package managers work, unfortunately. The login’s security can be improved, via things like 2fa, but it’s currently very bad. Having multiple parties use keys to sign packages after reviewing all changes, is a thing unique to distro package managers, and it is why Linux distros are extremely resilient against supply chain attacks.