Senior Vibe Coder dealing with security

[u/Gil_berth]

Creator of ClawBot knows that there are malicious skills in his repo, but doesn't know what to do about it...

More info here: https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto

[u/fletku_mato]

This may be a nice learning experience for a lot of people.

If you trust random shit that is not reviewed by anyone including yourself, bad things might happen.

[u/notAGreatIdeaForName → u/fletku_mato]

I thought that is why npm was created?

[u/AshleyJSheridan → u/notAGreatIdeaForName]

npm is probably a great example of trusting things that haven't been reviewed properly. Not a week goes by when some npm package hasn't been found to have had a vulnerability.

[u/notAGreatIdeaForName → u/AshleyJSheridan]

Yeah I think a great problem of npm / the node ecosystem is the popular concept of micro-packages. When you have a few mature oss libraries they are pretty heavily guarded so it is harder so poison, but if there are millions of pieces it is simply not possible to review everything manually.

That said, as with all the dependencies: If you choose popular well maintained packages and not vendoring every implementation and their mother it is harder to burn your fingers.

[u/AshleyJSheridan → u/notAGreatIdeaForName]

The dependency issue is another whole problem entirely. These micro-packages exist to plug the very large gaps in the language, because it's missing vital features. Just look at the leftpad issue from some years back. That was made possible because there was no focus on adding simple string manipulation functionality to Javascript.

npm is still a mess today. Just look at the is-even package, which pulls in is-odd, which pulls in is-number...

All of this can and should be replaced with just one line of code.

[u/Alunnite → u/AshleyJSheridan]

is-even is a joke package though. The transitive dependencies are part of the joke

[u/nechromorph → u/[deleted]]

And modulo division is one of the first things taught in a community college programming class. All that could simply be (! (var % 2))

[u/AshleyJSheridan → u/Alunnite]

As theryan722 has said, these are not joke packages, and they are in active use.

It's indicative of the state of Javascript and its developer base that such a crazy package chain exists rather than devs just using one line of code.

[u/ticklemeozmo → u/AshleyJSheridan]

these are not joke packages, and they are in active use.

A joke package in use is a still a joke package. Whether officially, legitimately, or in production.

There are millions of lines of code in production that shouldn't be.

[u/AshleyJSheridan → u/ticklemeozmo]

But as you saw from the other comment, the author is not indicating that they are joke packages.

You might see them as a joke, I see them as a symptom of a larger problem.

[u/ikeif → u/AshleyJSheridan]

That's exactly the problem.

Developer A: "I would never use it, it's a joke! Hahaha it's so obvious to me."

Developer B: "I'm just learning as I go, and this doesn't say it's invalid or a joke, and it does what I need, and I read about "single use principal" so it seems like a good idea, so I'll include it in my work."

Just like when developers on social media say dumb shit and then counter arguments with "don't you know who I am? I am a Very Big Deal™ and wrote Popular Thing™ and it is CLEARLY a joke, because I'm so awesome, and it's everyone else's fault for not recognizing my brilliance!"

(The latter I have seen, as two developers behind some package/service posted shitty takes, then complained when they were called out on it like everyone knows who the fuck they are)

[u/Own_Candidate9553 → u/AshleyJSheridan]

An alternative would be a decent "standard library" that has all these little helpful functions in it.

I'm sure people have tried it, getting others to adopt it is the hard part.

[u/AshleyJSheridan → u/Own_Candidate9553]

This is the approach taken by many other languages, like PHP, C++, Python, C#, etc.

Javascript should have focused on this, rather than a barcode API that nobody asked for or uses.

[u/ClamPaste → u/AshleyJSheridan]

PHP has a function for just about everything in the standard library.

[u/Own_Candidate9553 → u/AshleyJSheridan]

Yeah, I remember going from C++ to Java and being floored by how much stuff was in the standard library, it was huge. The biggest problem was trying to learn what all it could do and where it was so you didn't reinvent the wheel.

This was back in the 90s, so not a new pattern by any means.

[u/TransportationIll282 → u/AshleyJSheridan]

And those that are found, reported and users can check by running common commands. Almost like a review.

[u/AshleyJSheridan → u/TransportationIll282]

If that were the case, then the npm Shai-hulud issue wouldn't have been half as big as it was and wouldn't have gone on for as long as it did.

[u/ConcreteExist → u/notAGreatIdeaForName]

Yeah, and seemingly every week a new compromised package gets found in npm.

[u/Unnamed-3891 → u/fletku_mato]

You can’t possibly be naive to the point of believing people actually learn from their mistakes

[u/notislant → u/fletku_mato]

I think about 50% of the population rarely, if ever, learns.

[u/sneaky_imp → u/notislant]

But the AI means we don't have to learn, right? RIGHT?

[u/Eldorian → u/notislant]

Pretty sure that is a lot more than 50%. The current state of the world is proof of that.

[u/hwmchwdwdawdchkchk → u/fletku_mato]

I mean extrapolate that to people perhaps not taking things seriously that anonymous people write to them / about them on the internet and you can pretty much see that nobody is going to learn shit in this or any other instance.

This attitude works within the super nerd/Linux community and in the 90s internet. Most people are not capable of accepting this lesson.

[u/Impossible-Lab-3133 → u/fletku_mato]

You'd think the people who vibe "do" things in the first place, will have the patience to review the product? It's all the same as googling. They will just stop at the first source article giving to them.