| ▲ | joaomoreno 4 days ago |
| From sindresorhus: You can run the following to check if you have the malware in your dependency tree: `rg -u --max-columns=80 _0x112fa8` Requires ripgrep: `brew install rg` https://github.com/chalk/chalk/issues/656#issuecomment-32668... |
|
| ▲ | cgijoe 4 days ago | parent | next [-] |
| Sorry, I am unfamiliar with ripgrep. Is this simply scanning for the string `_0x112fa8`? Could we do the same thing with normal grep -r? |
| |
| ▲ | skrebbel 4 days ago | parent | next [-] | | yes. ripgrep just does it faster, is all. | | |
| ▲ | nothrabannosir 4 days ago | parent | next [-] | | But also respects .gitignore by default so I’m not sure you want to use ripgrep to scan your node_modules | | |
| ▲ | Fishkins 4 days ago | parent | next [-] | | For others who didn't know, the -u flag in the OP's command makes it so ripgrep _will_ search files even if they're gitignored | | |
| ▲ | postalcoder 3 days ago | parent [-] | | -u searches through ignored files -uu searches through ignored and hidden files (eg dotfiles) -uuu searches through ignored, hidden, and binary files (ie everything) |
| |
| ▲ | AkshatJ27 4 days ago | parent | prev [-] | | Isn't the intended behaviour of original comment checking the node_modules folder for the "infected" string. |
| |
| ▲ | hinkley 4 days ago | parent | prev [-] | | Make it work, make it right, make it fast. For security checks, the first 2 out of 3 is just fine. | | |
| |
| ▲ | EasyMark 4 days ago | parent | prev [-] | | [flagged] | | |
| ▲ | naikrovek 4 days ago | parent [-] | | I feel like you were trying to help here, but anyone can do this for themselves. Providing information in this way sort of indicates that you don't believe that the person you're replying to can do it on their own, and for that reason it's considered rude. | | |
| ▲ | tbossanova 4 days ago | parent | next [-] | | I see what you mean, but I actually think there is a place for copy/pasting AI responses. I think of it as a kind of cache, surely a HN comment being served to n users means less resources used and faster access than if all n did their own AI query. But then of course you don’t get exactly your preference e.g. you might prefer a terser response than what is pasted here. Interesting to see how the etiquette around this plays out over time. | | |
| ▲ | vasco 3 days ago | parent [-] | | If you ever wanted to share an AI response, you probably should share your prompt, not the response. But likely you should not share anything, for the reasons already explained. Your argument about saving energy makes zero sense if you have any understanding of orders of magnitude but I won't share what AI says about it. | | |
| ▲ | tbossanova 2 days ago | parent [-] | | Ironically you are being incredibly rude trying to support an argument that posting AI responses is rude. I guess we can conclude you know nothing about anything. | | |
| ▲ | vasco 2 days ago | parent [-] | | I never mention rudeness, I dont give a shit about random people online being "rude". It's just something I don't like, so I shared my opinion. |
|
|
| |
| ▲ | skygazer 4 days ago | parent | prev [-] | | Also, HN hates machine generated replies, especially the lengthy and overly verbose slop variety -- I think that probably eclipsed any perceived rudeness. |
|
|
|
|
| ▲ | yifanl 4 days ago | parent | prev | next [-] |
| Asking people to run random install scripts just feels very out of place given the context. |
| |
| ▲ | hunter2_ 4 days ago | parent | next [-] | | I would agree if this were one of those `curl | sh` scenarios, but don't we consider things like `brew` to be sufficiently low-risk, akin to `apt`, `dnf`, and the like? | | |
| ▲ | tripplyons 4 days ago | parent | next [-] | | Anyone can upload an NPM package without much review. For Homebrew, you at least have to submit a pull request. | | |
| ▲ | n8m8 3 days ago | parent | next [-] | | https://docs.brew.sh/Acceptable-Casks#apps-that-bundle-malwa... > Unfortunately, in the world of software there are bad actors that bundle malware with their apps. Even so, Homebrew Cask has long decided it will not be an active gatekeeper (macOS already has one) and users are expected to know about the software they are installing. This means we will not always remove casks that link to these apps, in part because there is no clear line between useful app, potentially unwanted program, and the different shades of malware—what is useful to one user may be seen as malicious by another. --- So there might be pull requests, but Brew's official stance is that they do not actively moderate casks for malware. I guess there's something built into the MacOS packaging step that help mitigate the risk, but I don't know much about it outside playing w/ app development in XCode. | |
| ▲ | what 3 days ago | parent | prev [-] | | Homebrew has been compromised before. To think it’s immune is a bit naive. | | |
| ▲ | n8m8 3 days ago | parent | next [-] | | Agreed that it's a bit funny given the context and no community-managed package manager should be 100% trusted. That said, I think rg is pretty well known to linux daily-drivers and they just wanted to share something quickly for powerusers who want to check their workspaces quickly. Probably better to just instruct n00bs to use grep than install a whole cli tool for searching Come to think of it, I wonder if a 2-phase attack could be planned by an attacker in the future: Inject malware into a package, flood guidance with instructions to install another popular tool that you also recently compromised... lol | |
| ▲ | tripplyons 3 days ago | parent | prev [-] | | I'm not saying its immune. I'm saying that NPM doesn't have as many protections, making NPM an easier target. |
|
| |
| ▲ | anthk 4 days ago | parent | prev | next [-] | | APT repos for Debian, Trisquel, Ubuntu... require far more checkings and bureaucracy. | | |
| ▲ | socalgal2 4 days ago | parent [-] | | I'll bet they don't. There's way to much churn for it all to be checked | | |
| ▲ | const_cast 4 days ago | parent | next [-] | | Churn? On Debian? It takes like 2 years to get up to date packages. This isn't NPM. | | |
| ▲ | SchemaLoad 3 days ago | parent [-] | | The xscreensaver dev managed to very easily slip a timebomb in to the debian repos. Wasn't obscured in any way, the repo maintainers just don't review the code. It would be physically impossible for them to review all the changes in all the programs. |
| |
| ▲ | justusthane 4 days ago | parent | prev [-] | | No, they are extremely well vetted. Have you ever heard of a supply chain attack involving Red Hat, Debian or Ubuntu repos? | | |
|
| |
| ▲ | dmitrygr 4 days ago | parent | prev [-] | | > don't we consider things like `brew` to be sufficiently low-risk, Like ... npm? | | |
| ▲ | fn-mote 4 days ago | parent | next [-] | | Nah… Everybody knows npm is a gaping security issue waiting to happen. Repeatedly. It’s convenient, so it’s popular. Many people also don’t vendor their own dependencies, which would slow down the spread at the price of not being instantly up to date. | | |
| ▲ | dabockster 4 days ago | parent | next [-] | | > Many people also don’t vendor their own dependencies, which would slow down the spread at the price of not being instantly up to date. npm sold it really hard that you could rely on them and not have to vendor dependencies yourself. If I suggested that a decade ago in Seattle, I would have gotten booed out of the room. | | |
| ▲ | marcus_holmes 3 days ago | parent [-] | | I have repeatedly been met with derision when pointing out what a gaping security nightmare the whole Open Source system is, especially npm and its ilk. Yet here we are. And this is going to get massively worse, not better. | | |
| ▲ | Intermernet 3 days ago | parent [-] | | Nothing specific to open source is to blame in this instance. The author got phished. Open source software often has better code vetting and verification than closed source software. npm, however, does not. |
|
| |
| ▲ | johnisgood 3 days ago | parent | prev | next [-] | | Convenient, as in the barrier to entry is way too low. I am pretty much against it. | |
| ▲ | albedoa 3 days ago | parent | prev [-] | | > Nah… I mean, I believe you, but the person you are replying to obviously believes that they are similar. Could you explain the significant differences? |
| |
| ▲ | hunter2_ 4 days ago | parent | prev [-] | | I thought getting code into brew is blocked by some vetting (potentially insufficient, which could be argued for all supply chains), whereas getting code into npm involves no vetting whatsoever. | | |
| ▲ | n8m8 3 days ago | parent [-] | | Went and found the link: https://docs.brew.sh/Acceptable-Casks#apps-that-bundle-malwa... > Unfortunately, in the world of software there are bad actors that bundle malware with their apps. Even so, Homebrew Cask has long decided it will not be an active gatekeeper (macOS already has one) and users are expected to know about the software they are installing. This means we will not always remove casks that link to these apps, in part because there is no clear line between useful app, potentially unwanted program, and the different shades of malware—what is useful to one user may be seen as malicious by another. |
|
|
| |
| ▲ | justusthane 4 days ago | parent | prev [-] | | ripgrep is quite well known. It’s not some obscure tool. Brew is a well-established package manager. (I get that the same can be said for said for npm and the packages in question, but I don’t really see how the context of the thread matters in this case). |
|
|
| ▲ | koolba 4 days ago | parent | prev | next [-] |
| Try the same recursive grep on ~/.npm to see if you have it cached too. Not just the latest in the current project. |
| |
| ▲ | tripplyons 4 days ago | parent [-] | | Haven't installed any modules today, but I ran these commands to clear caches for npm and pnpm just to be safe. npm cache clean --force
pnpm cache delete | | |
|
|
| ▲ | dabockster 4 days ago | parent | prev | next [-] |
| Here's something I generated in my coding AI for Powershell: `Get-ChildItem -Recurse | Select-String -Pattern '_0x112fa8' | ForEach-Object { $_.Line.Substring(0, [Math]::Min(80, $_.Line.Length)) }` Breakdown of the Command: - Get-ChildItem -Recurse: This command retrieves all files in the current directory and its subdirectories. - Select-String -Pattern '_0x112fa8': This searches for the specified pattern in the files. - ForEach-Object { ... }: This processes each match found. - Substring(0, [Math]::Min(80, $_.Line.Length)): This limits the output to a maximum of 80 characters per line. --- Hopefully this should work for Windows devs out there. If not, reply and I'll try to modify it. |
| |
| ▲ | metaltyphoon 3 days ago | parent [-] | | Or you can just install ripgrep on windows too and have it check much faster ;) |
|
|
| ▲ | 4 days ago | parent | prev | next [-] |
| [deleted] |
|
| ▲ | timsh 4 days ago | parent | prev | next [-] |
| If it produces no output, does that mean that there's no code that could act in the future?
I first acted out of nerves and deleted the whole node-modules and package.lock in a couple of freshly opened Astro projects, curious if I should considered my web surfing to still be potentially malicious |
| |
| ▲ | nosefurhairdo 4 days ago | parent [-] | | The malware introduced here is a crypto address swapper. It's possible that even after deleting node_modules that some malicious code could persist in a browser cache. If you have crypto wallets on the potentially compromised machine, or intend to transfer crypto via some web client, proceed with caution. |
|
|
| ▲ | aerodynamic_ 4 days ago | parent | prev | next [-] |
| convenience script that checks through package.json dependency tree + a couple malicious binary patterns: https://gist.github.com/edgarpavlovsky/695b896445c19b6f66f14... |
| |
|
| ▲ | airtonix 4 days ago | parent | prev [-] |
| [dead] |
