32 replies

1. Alex Grant Mastodon 3 min later

   @zachleat

   I wish we all used socket.dev and published with provenance directly from github.

   It's free and takes just minutes to setup with your pipeline.

   1. Zach Leatherman Mastodon 6 min later

      @localnerve I’m not sure this would fix it? I think https://docs.npmjs.com/trusted-publishers is the new thing that might help prevent bad publishes from other workflows https://docs.npmjs.com/trusted-publishers

      1. Alex Grant Mastodon 20 min later

         @zachleat

         This is the workflow we use, yes? I see 11ty has this also. This, combined with the workflow and socket.dev integration is what stopped me at ~10:20am this morning.

         It won't fix everything, no.

         The error-ex case today, by examining the delta between the source code on github and the package delivered by npmjs, indicates ppl (or agents acting on their behalf) are publishing directly, injecting code. The packages have code different from the repo, and pub provenance eliminates that.

         1. Zach Leatherman Mastodon 31 min later

            @localnerve ah, yeah — for sure. I just mean that packages using provenance aren’t *required* to use provenance to publish (which was an interesting design decision)

            1. Alex Grant Mastodon 45 min later

               @zachleat

               I think we're quickly heading to a point where it will be a requirement.

               Ppl doing strategic forks (fork, contribute, but republish with provenance) will help drive this. Ppl with bigger budgets have to drive this for bigger packages.

               I cant believe packages like #jest have the dep supply chain they have. That's major.

               We gotta get better.

               1. David Anson Mastodon 2 hr later

                  @localnerve @zachleat Personal opinion: Provenance is pretty worthless. https://dlaa.me/blog/post/npmprovenance

2. Khalid ⚡ Mastodon 4 min later

   @zachleat *npm

   *npm is Microsoft

   1. Zach Leatherman Mastodon 5 min later

      @khalidabuhakmeh *edited, thank you

   2. Khalid ⚡ Mastodon 1 hr later

      @zachleat This is fine…

      1. Zach Leatherman Mastodon 2 hr later

         @khalidabuhakmeh hopefully we can get some workflow improvements to npm to avoid or at least better mitigate these problems

         1. Khalid ⚡ Mastodon 2 hr later

            @zachleat AI?

            1. Zach Leatherman Mastodon 2 hr later

               @khalidabuhakmeh *eyes narrow*

               1. Thibault D. Mastodon 2 hr later

                  @zachleat @khalidabuhakmeh 😂 😅 😂 😭

3. Zach Leatherman Mastodon 58 min later

   simple-swizzle@0.2.3 is *still* public, active, and in the wild. You can see the malicious code on the code browser: https://www.npmjs.com/package/simple-swizzle/v/0.2.3?activeTab=code

   Edit: seeing folks boost this one still but editing to say that it’s been resolved

   1. Private reply Mastodon 1 hr later
      1. Private reply Mastodon 1 hr later
         1. Private reply Mastodon 1 hr later
   2. Zach Leatherman Mastodon 1 hr later

      whew, it’s been taken down a mere 5 hours after publish.

      1. Slab Bulkhead Mastodon 1 hr later

         @zachleat the cheap joke: someone at npm finally got VP level permission to turn off Copilot to make the change.

         1. Zach Leatherman Mastodon 1 hr later

            @slab_bulkhead vibe coding our way to a fix

      2. Alex Grant Mastodon 5 hr later

         @zachleat

         Still cached. Still rocking the exploit.

         #jest download after 6pm eastern still delivering 64k of injected who-knows-what

         1. Zach Leatherman Mastodon 5 hr later

            @localnerve your local cache might still have it, I suppose!

            1. Alex Grant Mastodon 5 hr later

               @zachleat

               Oh eek. Thanks 👍

   3. Stuart Langridge Mastodon 1 hr later

      @zachleat the is-arrayish half of this broke our build today: purely fortunate that (I think that) the people who compromised the package screwed up the package.json. It was rectified pretty fast, but... bit worrying.

      1. Zach Leatherman Mastodon 1 hr later

         @sil yeah, absolutely. `is-arrayish` is a wild package to begin with

         1. Stuart Langridge Mastodon 1 hr later

            @zachleat ya. I'd never heard of it, and was a bit surprised when I found what it was (it turned out, obviously, to be somewhere about nine layers deep in the dependency tree). That trend for single-line packages is pretty annoying.

4. Luke Mastodon 1 hr later

   @zachleat But using all manner of random stuff off npm is fine everyone, we definitely don't have a massive issue as an industry 😅

   1. Zach Leatherman Mastodon 2 hr later

      @Lukew something needs to change or folks are going to hop off of the package manager train (and then we’ll have worse problems due to folks not updating things)

5. Bruce Lawson ✅ ♫ ♿ ✌️♂️✊ Mastodon 14 hr later

   @zachleat maybe don't install anything from npm *ever*.

   1. Zach Leatherman Mastodon 20 hr later

      @brucelawson oh no

      1. Bruce Lawson ✅ ♫ ♿ ✌️♂️✊ Mastodon 20 hr later

         @zachleat I'm selling CDs of installable binaries of 11ty, earning a fortune

         1. Zach Leatherman Mastodon 20 hr later

            @brucelawson build 50 pages, get the next 50 free!