Useful library dependency
npm package to upload your private ssh keys to a pastebin. It also provides string dedentation.
npm i actual-malware
yarn add actual-malware # alternative
# alias for convenience:
npm i actma # roadmap
yarn add actma
Congratulations, all your ssh keys should now be available in a public pastebin! (Preinstall hook)
Update: It looks like the npm team took down the package 🎉 . archived link. I still think it is far too easy to put malware in packages and far too hard to detect when you've been compromised, but I'm pleased they were able to take it down after only about 300 users installed the package. (If this repo implemented one of the worms outlined below then 300 users would probably be more than enough to seed most active packages on npm.)
import { dedent } from 'actual-malware' // or actma
const prettyString = dedent(`
the rains and
spains
fall`) // preserved
// doing this in a browser could put all session cookies in a pastebin
console.log(prettyString)
^ Note that I am not in sudo mode, I am never prompted for my password, and there is no indication that the installation had any side effects.
NPM recently removed the ability for users to report compromised packages. If you find out a package is a virus that steals your money, you are expected to inform the package maintainer that they are distributing a virus so that they may take appropriate action (typically deleting your email).
Popular npm packages have thousands of dependencies. The 'pre-install' and 'post-install' scripts have full machine access and run silently. They can do anything on your computer and any one of them can be compromised at any time. Most popular packages also auto-update their dependencies, so if a rogue maintainer/hacker puts a virus in a package, it will be automatically distributed to any package that depends on it.
I'm hoping the community sees demonstrations like this and reduces the risk to users somehow. (See what-can-we-do section.)
YES
(Git is actually the only who did things right here. Git hooks don't come with the repo when you clone it. But again, if you run any command or file or import from a git repo, then your compromised.)
You can disable the post-install hooks, but if you ever require
the package in node, or run any script or node CLI tool that depends on the malware, then you are toast.
Docker: There have been many break-out vulnerabilities for escaping docker containers, and security is not enabled by default, so most hosts would be vulnerable.
word2vec-weights.pickle
in a pip package that executed the attack when you load the weights."What about watching outbound network traffic?" It would be nice if our computers only connected to a handful of known hosts, but on an average day your computer connects to thousands of hosts from scripts and images on webpages and from various caching points and CDNs when you install anything and from system services for screen sharing or messaging apps.
Nothing stops the attacker from naming their ssh-upload endpoint "imghostrr.com/puppy.png"
All of our package registries are basically screwed. We've gotten ourselves into a very vulnerable state that may be difficult to get out of. But here are some measures that could help a bit:
npm update
from installing updates with reported malware. (Likewise for pip, brew, apt, etc)I would say that you can compile binaries yourself, but it is really some trouble, and for some reason, apt
and brew
seem to be much less prone to attack than npm
and pip
. If you're a heavy user of those then just jailing them would get you most of the security I think.
actual-malware
unpkg dependency to all index.html
files on system. (Should catch a few popular websites.)(/joke)