What's in your package.json?
Tobie Langel, Open source strategist and Principal at UnlockOpen, joins Chris, Feross, and Amal to discuss recent widespread incidents affecting the JavaScript community (and breaking CI builds) around the globe. Two widely used npm libraries were self-sabotaged by their single maintainer, yet again, highlighting the many gaps in our OSS supply chain security, sustainability and overall practices. We explore all these topics and solution on what our ecosystem needs to be more resilient to these types of attacks in the future.
Matched from the episode's transcript đ
Feross Aboukhadijeh: Iâll just second what Tobie said⌠I think weâve been super-lucky with the types of attacks that weâve seen so far. It could be much worse than what we saw in this particular attack. I think weâre starting to see these kinds of supply chain attacks happen on a much more regular basis. Itâs sort of picked up in 2021, and it hasnât really let go since. I see a headline about something like this every two weeks, it seems like; sometimes even more frequently. And if you look at the kind of packages that are being affected, theyâre all these pretty headline-grabbing numbers in terms of downloads.
So the two packages in this incident were faker.js, which has ten million downloads a month, and color.js, which has one hundred million downloads a month. But weâve also seen attacks against UAParser.js and COA, as well as RC⌠And all of those packages had at least 30 million downloads a month each. When malware makes it into one of these packages, through whatever mechanism - you know, in this case it happened to be the maintainer themselves who added the malware. In the case of the three I just mentioned, UAParser.js, COA and RC - those ones were actually a third-party who got access to the modules and added malware to them.
In all these cases I feel like the attacks have been pretty naive and caught pretty quickly. Weâre not really looking at super-sophisticated actors here. In the case of faker and color it was very obvious that something had happened, because the packages were outputting gibberish code, infinite loops, sort of outputting the Unicode text â it was very obvious that something had happened to the package.
And then in the case of the three I mentioned earlier - all of those were pretty obvious as well. There were crypto miners added to the modules, so when you updated, your CPU usage would just go straight to 100% and it would be mining crypto for the attacker. So this isnât like a super-sophisticated thing; it gets caught within a couple of days. Someone notices, the malware gets removed from npm, and then we write a bunch of new stories about it and people talk about it.
There have been hints at much more scary attacks. If you go back to 2018 with event-stream. The event-stream incident was much more sophisticated. A bit of obfuscated code added to one of Dominic Tarrâs packages when he gave up the package to another maintainer to take over after he was done working on it⌠And in that case, that was an attack that targeted one very specific company. And it was a no-op for everybody else. And so that went undetected for much longer. I just think itâs interesting that we havenât seen anything that sophisticated since 2018, which makes me think either people just have forgotten that those things exist, or maybe weâre just not finding them, which is the much scarier thought.
