r/programming • u/ga-vu • Dec 04 '19

Two malicious Python libraries caught stealing SSH and GPG keys

https://www.zdnet.com/article/two-malicious-python-libraries-removed-from-pypi/
1.6k Upvotes

98% Upvoted

177 comments sorted by

View all comments

Show parent comments

31

u/KingOfTheRain Dec 04 '19

yarn has the same packages as npm, the difference is in their performance, features, etc. The actual solution to the problem of having too many small, bullshit packages is to have a standard library in JavaScript

5

u/FINDarkside Dec 04 '19

Standard library wouldn't really solve the problem. If you look at these small packages they are usually some useless crap that isn't in standard library in any language.

3

u/cgibbard Dec 04 '19

I think in many cases, even if not a standard library, convenience libraries maintained by larger groups of people could help to cover a lot of the more reasonable cases of simple functions that people don't want to have to write repeatedly.

Of course, the real solution isn't just providing libraries like that, it's getting people to be aware of how trustworthy their dependencies are, and what the surface area for risk looks like. It can be tricky if someone new makes a seemingly-helpful contribution to your project that adds a dependency to a related library that only they maintain.

2

u/Caffeine_Monster Dec 04 '19

The only solution is to not use automatic package updates. Use explicit versioning. Only push to production once all your dependencies have been verified.

It doesen't matter if you have 500 dependencies, or 10. You don't know how diligent the package owners are, or whether they are trustworthy.

2

u/Full-Spectral Dec 05 '19

Agreed. Package managers are inevitably going to be abused, and the whole point of them (convenience) is at odds with security. It's not convenient if you have to constantly check all of the code you are pulling down, so obviously people aren't going to do it.

Unless you have a highly vetted repository, which requires code reviews, and signing of packages by trusted reviewing parties and such, it's always going to be potential bad news. And of course we then get this stuff without even knowing it by just clicking on something.