A real issue, but its also a bit funny an article about impersonation is coming from a site called “thehackernews,” a site that is clearly trying to ride the popularity of the much better known forum/news aggregator hackernews.
Why does it seem to be specifically npm packages being attacked/mimicked to spread malware? I don’t see the same for nuget or maven, for example. Not to say they don’t have the same issue, just vastly fewer issues? Maybe I just don’t see the information - is it just that npm is used so much more, in general, so its the best attack vector?
In my (non-expert) opinion, there are a few reasons
- NPM is more popular than those other services by an order of magnitude, especially among new developer and startups.
- NPM allows for code to be executed while you install the package which is different from maven or nuget and allows for easy exploitation paths
NPM allows for code to be executed while you install the package which is different from maven or nuget and allows for easy exploitation paths
This is the winner. Combine that with a vastly bigger group of inexperienced developers (and I’m willing to die on that hill), and you have a lot of people running node / npm as an admin / root user, who have close to zero idea what they are doing, hitting their project with third party dependencies left and right for no particular reason (left-pad, is-number, ansi console and similar useless crap), and then your dependency management allows for code execution. Also, from my personal feeling, it seems that npm simply cannot properly audit the packages due to the sheer mass. From a technical standpoint it’s close to trivial to put your malware onto npm, and then you just need to get someone to install your package, which is way simpler than in other package managers
