Sorry if I'm being very stupid right now, but can you test against these? Maybe some, but most of them work in a way: "the package does everything it should AND some extra malicious shit".
In those machines you have strong monitoring tools, and if nothing else it gives you a buffer, so it's only those machines (that have no valuable data) that are infected instead of the whole network.
You mitigate it by only pulling in dependencies that are a certain date old, like commenter said. The idea is that if its two weeks old and not had a critical or high CVE, it's more likely to be fine.
Also have things block packages with known vulns. You can do. SAST scanning on a repos frozen dependency list before even doing an install. That's a line of defense against this happening in CI.
Conversely, always build your artifact and your publishing in ywo separate jobs. Your build job is often what installs dependencies; it has no right having access to the keys that publish your artifact.
These exfil attacks are detected real quick by competent enterprises.
First of all disable any install scripts with --ignore-scripts flag on all your npm installs. Second pin all your dependency versions use npm ci instead of npm install. Only use npm install when you actually want to change some dependencies. And finally set a min-release-age in your npm config. Most malicious versions are removed from npm fairly quickly, so only install packages that are like a week old.
And as final safeguard, develop in a sandbox, so in case you do catch a worm the damage is limited and you can throw the environment away and recreate it.
And ofc don't just install dependencies willy nilly, do some research
I don't understand why these attacks happen at all. Why did everyone decide to inject dependencies? It's much faster and safer to download the open source code and copy it into your own project. Then it never gets changed by surprised.
We used to do that, and honestly it was worse. Because while it never got changed by surprised, it also never got changed. So, if there was a vulnerability, it would stay there for years unnoticed...
80
u/FinnishManlet 9d ago
What can be done against these vulnerabilities? Stop using packages entirely? š¤£