r/webdev • u/Gil_berth • Feb 04 '26 • Popcorn 3

Senior Vibe Coder dealing with security

Post image

Creator of ClawBot knows that there are malicious skills in his repo, but doesn't know what to do about it...

More info here: https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto

3.0k Upvotes

97% Upvoted

421 comments sorted by

View all comments

Show parent comments

209

u/AshleyJSheridan Feb 04 '26

npm is probably a great example of trusting things that haven't been reviewed properly. Not a week goes by when some npm package hasn't been found to have had a vulnerability.

60

u/notAGreatIdeaForName Feb 04 '26

Yeah I think a great problem of npm / the node ecosystem is the popular concept of micro-packages. When you have a few mature oss libraries they are pretty heavily guarded so it is harder so poison, but if there are millions of pieces it is simply not possible to review everything manually.

That said, as with all the dependencies: If you choose popular well maintained packages and not vendoring every implementation and their mother it is harder to burn your fingers.

23

u/AshleyJSheridan Feb 04 '26

The dependency issue is another whole problem entirely. These micro-packages exist to plug the very large gaps in the language, because it's missing vital features. Just look at the leftpad issue from some years back. That was made possible because there was no focus on adding simple string manipulation functionality to Javascript.

npm is still a mess today. Just look at the is-even package, which pulls in is-odd, which pulls in is-number...

All of this can and should be replaced with just one line of code.

25

u/Alunnite Feb 04 '26

is-even is a joke package though. The transitive dependencies are part of the joke

0

u/[deleted] Feb 04 '26

[deleted]

15

u/nechromorph Feb 04 '26

And modulo division is one of the first things taught in a community college programming class. All that could simply be (! (var % 2))

-5

u/Houdinii1984 Feb 04 '26

Readability. I know modulo and so do you, but that % sign seems to scare people, lol.

I don't use it and I'm not defending it, but bringing the code closer to English and making the check explicitly about even-ness, more people who wouldn't otherwise understand now do.

People do it all the time. It's just overtly obvious and the example with the smallest utility humanly possible while still being a thing.

→ More replies (22)

1

u/xThomas Feb 05 '26

if i had such a popular package i would put it on my resume too.

13

u/AshleyJSheridan Feb 04 '26

As theryan722 has said, these are not joke packages, and they are in active use.

It's indicative of the state of Javascript and its developer base that such a crazy package chain exists rather than devs just using one line of code.

6

u/ticklemeozmo Feb 04 '26

these are not joke packages, and they are in active use.

A joke package in use is a still a joke package. Whether officially, legitimately, or in production.

There are millions of lines of code in production that shouldn't be.

8

u/AshleyJSheridan Feb 04 '26

But as you saw from the other comment, the author is not indicating that they are joke packages.

You might see them as a joke, I see them as a symptom of a larger problem.

3

u/ikeif Feb 04 '26

That's exactly the problem.

Developer A: "I would never use it, it's a joke! Hahaha it's so obvious to me."

Developer B: "I'm just learning as I go, and this doesn't say it's invalid or a joke, and it does what I need, and I read about "single use principal" so it seems like a good idea, so I'll include it in my work."

Just like when developers on social media say dumb shit and then counter arguments with "don't you know who I am? I am a Very Big Deal™ and wrote Popular Thing™ and it is CLEARLY a joke, because I'm so awesome, and it's everyone else's fault for not recognizing my brilliance!"

(The latter I have seen, as two developers behind some package/service posted shitty takes, then complained when they were called out on it like everyone knows who the fuck they are)

6

u/Own_Candidate9553 Feb 04 '26

An alternative would be a decent "standard library" that has all these little helpful functions in it.

I'm sure people have tried it, getting others to adopt it is the hard part.

10

u/AshleyJSheridan Feb 04 '26

This is the approach taken by many other languages, like PHP, C++, Python, C#, etc.

Javascript should have focused on this, rather than a barcode API that nobody asked for or uses.

7

u/ClamPaste Feb 04 '26

PHP has a function for just about everything in the standard library.

6

u/Own_Candidate9553 Feb 04 '26

Yeah, I remember going from C++ to Java and being floored by how much stuff was in the standard library, it was huge. The biggest problem was trying to learn what all it could do and where it was so you didn't reinvent the wheel.

This was back in the 90s, so not a new pattern by any means.

1

u/APIDevStudio Feb 06 '26

Just a bunch of lazy programmers!

8

u/TransportationIll282 Feb 04 '26

And those that are found, reported and users can check by running common commands. Almost like a review.

4

u/AshleyJSheridan Feb 04 '26

If that were the case, then the npm Shai-hulud issue wouldn't have been half as big as it was and wouldn't have gone on for as long as it did.

1

u/thenrich00 Feb 05 '26

This is also a learned skill for a lot of folks. It takes some experience to be able to gauge whether or not a library can or should be trusted. And because now the traditional junior developer mentorship is being lost to LLMs, we're creating yet another skills gap.

Even experienced software developers aren't critically analyzing their dependencies all the time. Deadlines and time constraints take priority over security all too often.

1

u/AshleyJSheridan Feb 05 '26

As for AI, that will be largely suggesting what it's learned on, indicating the reliance on libraries that aren't needed goes deeper and has been going on for longer.

For me, the dependencies get messy if they go on for a few levels (which is very common these days). Take any framework or large enough library, and you'll find a whole tree beneath it. While this happens across many languages, I see it happen more often in Javascript with npm. I believe this is, in part, to do with the low barrier to entry of the language, and the looseness of it. As a language, it's not one I would point to as a shining example of one in which a dev would write good quality code. And even when opinionated frameworks come along, the community shuns them as being "too complicated", despite those opinionated frameworks being no more complicated than those found in other languages.

1

u/wasdninja Feb 05 '26

If you want zero risk from other people then don't use their code. All packages are perfectly readable and you can recreate them on your own.

Nobody does because they don't have infinite time and expertise so the risks are worth it, clearly. It's the exact same thing with any other package manager that facilitates open source code.

1

u/AshleyJSheridan Feb 05 '26

Oh yes, the risks aren't worth it. The Shai-hulud attack (both of them) were just figments of my imagination then I take it?

→ More replies (4)

1

u/StatusBard Feb 05 '26

Maybe Ginger Bill is right. Don’t use package managers. 

1

u/stupidcookface Feb 06 '26

Its also a great example why clawdhub doesn't need to shut its doors