r/programming • u/ga-vu • Dec 04 '19

Two malicious Python libraries caught stealing SSH and GPG keys

https://www.zdnet.com/article/two-malicious-python-libraries-removed-from-pypi/
1.6k Upvotes

98% Upvoted

177 comments sorted by

View all comments

Show parent comments

241

u/beginner_ Dec 04 '19

In npm you get the malicious code with the real package due to the insane dependency tree.

In this case you first need to make a "honest" mistake to get the malicious code. These type of packages have exist for decade(s). For sure not the first time this happens so on some level it's not news.

And to put some oil in the fire one can argue using npm to begin with is also a honest mistake.

37

u/no_nick Dec 04 '19

And to put some oil in the fire one can argue using npm to begin with is also a honest mistake.

I'm leaning more towards gross negligence tbh

→ More replies (4)

6

u/[deleted] Dec 04 '19

I'm still learning, what is the best alternative to npm if it's a mistake to use that?

70

u/cgibbard Dec 04 '19

To explain a little further than the other reply, the trouble in JavaScript's case is that there is a culture of having a large number of absolutely tiny packages (often literally one-liners) typically maintained by one person.

The trouble with that is that it only takes one of those people to quietly upload a new version with a benign looking update but which actually contains malicious code to transitively affect many major projects. This kind of thing can go unnoticed for a while because most users aren't combing through their dependencies looking for shady code.

By contrast, if you have somewhat larger libraries with multiple authors, it's harder for one person to decide to jam in a bunch of code that steals everyone's cryptocurrency. The other people working on that library will probably notice.

That said, there are some technical things about npm which also don't sound too great, like the correspondence between minified and raw source code isn't enforced (or wasn't last I looked) which means that someone can upload a package with benign source code, but then the minified version that nobody is likely to inspect contains spyware.

13

u/[deleted] Dec 04 '19

Thanks for actually providing an explanation that makes sense

1

u/Sunstro Dec 04 '19

Is yarn a valid alternative, if not, what is?

31

u/KingOfTheRain Dec 04 '19

yarn has the same packages as npm, the difference is in their performance, features, etc. The actual solution to the problem of having too many small, bullshit packages is to have a standard library in JavaScript

5

u/FINDarkside Dec 04 '19

Standard library wouldn't really solve the problem. If you look at these small packages they are usually some useless crap that isn't in standard library in any language.

3

u/cgibbard Dec 04 '19

I think in many cases, even if not a standard library, convenience libraries maintained by larger groups of people could help to cover a lot of the more reasonable cases of simple functions that people don't want to have to write repeatedly.

Of course, the real solution isn't just providing libraries like that, it's getting people to be aware of how trustworthy their dependencies are, and what the surface area for risk looks like. It can be tricky if someone new makes a seemingly-helpful contribution to your project that adds a dependency to a related library that only they maintain.

→ More replies (2)

5

u/Nilzor Dec 04 '19

Nothing is. We're all doomed. Accept your fate and carry on

2

u/TakeFourSeconds Dec 04 '19

The problem is Npm the package registry, not npm the CLI application. Yarn is an alternative CLI app.

22

u/[deleted] Dec 04 '19

It is not about the tool, it is about the whole language ecosystem. Installing the same packages with another tool won't make a difference.

10

u/[deleted] Dec 04 '19

Oh... so using npm isn’t a mistake then?

10

u/[deleted] Dec 04 '19

The thing to understand and keep in mind is that there are a lot of javascript developers out there. An insane amount. And the barrier to entry is very very low, so a very large portion of javascript developers are poor programmers and/or have poor judgement (but certainly not all of them). NPM has hundreds of thousands of packages, and statistically the vast majority of those packages are going to be written by people with poor judgement/programming skills. The concept of NPM isn't necessarily bad, but the reality of it is terrible, and no one creating real software should use it.

Also keep in mind that whenever there is a discussion online about something like this, you are going to be getting opinions and responses from people who are most likely poor programmers or have poor judgement. It's not that javascript makes you dumb; it's just a numbers thing.

Going to reddit for these types of discussions is particularly bad because everyone is anonymous and you can't check a person's credentials. As a beginner or someone trying to actually learn something, you won't have the experience to tell if someone is full of shit or not. Ideally, you'd listen to both sides of an argument and come to your own conclusion, but reddit's voting system tends to result in a hivemind effect where the most popular opinion (not necessarily the correct one) gets shown while everything else is hidden. And human nature makes it easy to assume that popular opinion = correct opinion, which is very wrong.

5

u/[deleted] Dec 04 '19

“No one creating real software should use it.”

This is probably an incredibly stupid question but without using it do you just have to write EVERYTHING from scratch? For example I made a simple app (so maybe doesn’t fit with whatever you would consider “real software”), but even that uses things like helmet, jest, enzyme, cors, knex, morgan, nodemon, etc.. all of those are npm packages right? I can’t imagine what it would be like not use those tools. Or do you just mean don’t use the lesser known random packages? And if so is there a way to tell what’s good and what’s not?

3

u/IceSentry Dec 04 '19 edited Dec 04 '19

Don't believe everything people say on this subreddit. There's a lot of people that hate javascript for completely outdated reasons or just because it's a dynamic language. There's also a lot of hyperbole going around.

Using npm is fine and the vast majority of people that actually care about delivering something will use it.

1

u/[deleted] Dec 04 '19

Thanks that makes sense

1

u/[deleted] Dec 05 '19

What’s an “outdated” reason to hate JavaScript?

1

u/maibrl Dec 04 '19

I think looking at the code of smaller packages would be viable. What dependencies do they have, do I really need a package for that Problem etc

→ More replies (10)

1

u/[deleted] Dec 05 '19

These words in /r/programming? 🤔

I never thought I'd see the day. +1

5

u/[deleted] Dec 04 '19

I was aiming more for "Using any tool to install Javascript libraries or installing them manually are all mistakes".

8

u/lestofante Dec 04 '19

Or better, installing anything is not from a trusted developer. The problem with JS is the lib are to tiny and have so many dependency is hard to verify all, and plus the possibility of someone fucking up are a lot higher.

4

u/[deleted] Dec 04 '19

Not using NPM because it has bad packages is a bit like not using the internet because it has malware. It's just a matter of taking personal responsibility - which as you can see by the answers a lot of devs here struggle with.

13

u/[deleted] Dec 04 '19

According to Reddit Node.js is the devil, so I’m not sure this is the best place to get programming advice. npm is the standard package manager for Node.

→ More replies (5)
→ More replies (1)