At this point, any package adding a pre-install hook where there previously was not one should be denied and treated with extreme suspicion.

It's time pre-install / post-install hooks were killed off. Start with a moratorium on any new ones.

▲

jitl an hour ago | parent | next [-]

yeah but they can just put the dropper, etc in index.js, so that it runs at import time rather than at install time, no? i guess first-install time is often a privileged developer machine, and will execute in a "server"-like runtime such as Node, Bun, Deno. but blocking preinstall scripts is basic first aid...

▲

insanitybit 10 minutes ago | parent | next [-]

Prod tends to have less privileges than CI/CD. CI/CD tends to be full admin, so it's far more sensitive. Prod tends to have tooling for detecting breaches, better logging, etc. People tend to use containers, which act as a sandbox.

Prod also won't be wormable the way that CI/CD is. With CI/CD I can own another dev, use their creds to push another malicious build script, etc. "Attacker is in my prod env" isn't wormable.

Yes, capabilities in prod would be hugely beneficial but removing CI/CD is massive as a win.

▲

jerf an hour ago | parent | prev | next [-]

Nobody is claiming this is a complete solution to security. I would call this "necessary but not sufficient". You won't get far as an engineer if you refuse to implement "necessary but not sufficient" changes because the change doesn't in and of itself one-shot the entire problem.

▲

rcxdude 34 minutes ago | parent [-]

The fact that it's not sufficient also largely means it's not necessary either, because the real solution is auditing and trusting the codebase as a whole. All you do when disabling install hooks is make a lot of situations much more difficult to handle.

▲

jitl 25 minutes ago | parent [-]

"make no mistakes" is not the "real solution"

	▲	rcxdude 20 minutes ago \| parent [-]
		Neither is 'close the gate with no fence on either side of it'. If you want to run code, you either need to run it in a sandbox or trust it. Choosing to run only part of the code is not really a solution. (if you want to disable such hooks yourself, then you may get some security by diversity because you're not using the common configuration. But if it becomes the default then these worms will switch to a different vector)

▲

sysguest 22 minutes ago | parent | prev [-]

well Deno has the necessary ingredients for defense: file-system permission by path

▲

insanitybit an hour ago | parent | prev | next [-]

You'll just end up with people running `./configure` scripts or whatever instead. The solution I've currently landed on is:

1. Audit build scripts/ proc macros for rust code (and mark with cargo-vet).

2. Have an isolated workflow for "build/test/push artifact to temporary place" (s3, github artifact, whatever). No API keys in this workflow.

3. Have another workflow that has the API keys to publish that grabs the artifact and then places it into a registry.

This creates clear separation of "code runs here" and "environment has privileges".

In my own slop-driven programming language I have build scripts declare their capabilities upfront so that you can statically reason about them (same with runtime permissions).

▲

mechazawa an hour ago | parent | prev [-]

iirc does pnpm not allow them by default. But even if we killed them off there would still be a chance of the malware hooking into something else or only working in cli applications.