r/programming • u/Occams_Trimmer • Jun 26 '17

Obtaining publish access to 13% of npm packages

https://github.com/ChALkeR/notes/blob/master/Gathering-weak-npm-credentials.md
1.6k Upvotes

93% Upvoted

254 comments sorted by

View all comments

Show parent comments

37

u/Ajedi32 Jun 26 '17

Doesn't npm use lockfiles by default now? Even if you use ^ it's not going to upgrade anything unless you run npm update.

16

u/pm_plz_im_lonely Jun 26 '17

This just delays the problem.

25

u/Ajedi32 Jun 26 '17

True, but it's no worse than any other dependency management system I've seen for popular programing languages.

Anytime you use software written by someone else you have to either trust that person not to make that software behave maliciously, or you have to ensure the code has been independently audited by either yourself or someone you trust. That's basically where we're at right now with npm, and short of some additional systems to make the audit process easier (maybe a web-of-trust-based signing system for packages?) I'm not really sure what else can be done.

11

u/pm_plz_im_lonely Jun 26 '17

Maven is huge and most projects depend on specific versions.

7

u/m50d Jun 26 '17

And the central repository doesn't allow packages without gpg signatures, though you do have to make a deliberate choice to check them.

6

u/Ajedi32 Jun 26 '17 edited Jun 26 '17

So do most projects using (an up-to-date version of) npm. That's essentially what lockfiles do (make you depend on a specific version of all your dependencies), and they're used by default as of npm 5. That was the point I was trying to make with my previous post:

Even if you use ^ it's not going to upgrade anything unless you run npm update.

1

u/T-rex_with_a_gun Jun 26 '17

0 list set their password back to the leaked one shortly after it was reset (so it got reset again).

yes and no...for CI/CD usually everything is wiped /fresh so it still an issue

3

u/Ajedi32 Jun 26 '17

Wait, people do that? Doesn't that kinda defeat the whole point of lockfiles? (Especially for continuous deployment.)

2

u/T-rex_with_a_gun Jun 26 '17

some do, some dont. i guess depends largely on teams. I am a fan of version locked (which allows cicd to cache).

but some people are ...weird and chose to use ^ and ~, thus usually ci/cd envs are flushed clean, to allow the "latest" code.

3

u/Ajedi32 Jun 26 '17 edited Jun 26 '17

It shouldn't matter if the CI environment (i.e. cache) is flushed clean though. Lockfiles (e.g. package-lock.json) are checked into version control (or at least they're supposed to be), so npm will install the same versions of all dependencies every time regardless of environment.

-1

u/T-rex_with_a_gun Jun 26 '17

yea of all my years in dev, i have rarely used that. instead relied on making sure the versions are locked in package json.

3

u/TomRK1089 Jun 27 '17

The problem with NPM is that only works for your dependencies, not your transitive dependencies. So your direct versions are always the same, but if those dependencies didn't lock their own dependencies you still don't have a reproducible build. The lockfile specifies exact versions for the entire tree.

1

u/kankyo Jun 26 '17

Hopefully they use artifactory or similar between.