The npm registry's safe word is Socket
- Reference: 1678990881
- News link: https://www.theregister.co.uk/2023/03/16/socket_npm_safe_javascript/
- Source link:
The npm registry, operated by NPM until the security biz was [1]acquired by Microsoft's GitHub in 2020, hosts software packages for the JavaScript ecosystem. It is, [2]by its own account , "the world's largest software registry."
In the past few years, the maliciously inclined have increasingly focused on compromising package registries like npm in what's known as a [3]supply chain attack . Subverting a popular software library has the potential to enable widespread viral distribution.
[4]
Those running the npm registry have put in place various defenses over the years, such as npm audit , [5]a vulnerability scanning command in the npm command line interface (CLI). But the tool's implementation leaves [6]something to be desired and developers often ignore audit warning messages, particularly if automated resolution doesn't work.
[7]
[8]
Socket built its own [9]vulnerability scanning system and last year made it available for free (with paid tiers for teams and organizations) for open source projects. Its scanner runs as a GitHub app on code repositories when changes are made. It catches [10]more issues than npm audit – covering not just supply chain risk but also quality, maintenance, vulnerability, and license concerns.
Ring in some changes
But Socket's scanner is also now [11]available as a CLI that developers can install on their machines. On Thursday, Socket updated its CLI with a safe npm command that defends developers whenever they invoke npm install or npm uninstall , which perversely can install packages amid removing others.
"npm creates what is called the 'ideal tree' for a given package.json ," explained Feross Aboukhadijeh, told The Register . "So by removing a package you might actually change what the ideal tree is. Removing a package may remove a constraint which is keeping a package on an older version, so then npm may update those packages to a more ideal/recent version."
The reason cause for this concern is that JavaScript packages distributed via npm can be compromised. According to Aboukhadijeh, Socket has seen more than 200 packages [12]removed just in the past 30 days.
[13]This JavaScript scanner hunts down malware in libraries
[14]Google debuts OSV-Scanner – a Go tool for finding security holes in open source
[15]Microsoft Azure developers targeted by 200-plus data-stealing npm packages
[16]Open source software has its perks, but supply chain risks can't be ignored
Aboukhadijeh said that the average npm package has 79 transitive dependencies, so installing one is likely to bring dozens of additional packages along for the ride. And vetting all of those manually is not something most people have the ability, time, or inclination to do.
While using npm audit may surface known vulnerabilities, the Socket CLI now goes deeper, thanks to the addition of the safe npm command. It can be set up by running npm install -g @socketsecurity/cli , which adds a socket command to the PATH environmental variable that specifies where executable programs can be found.
[17]
Thereafter, developers can invoke the tool by entering socket npm install instead of npm install . And aliasing the command can make this more convenient still. The org recommends adding alias npm="socket npm" to their .bashrc profile (or .zshrc , or whatever shell is being used) so that the familiar npm install invocation passes transparently to the Socket CLI.
Demo of an npm command-line interaction with Socket's safety on
"Socket’s safe npm tool transparently wraps the npm command and protects the developer from malware, typosquats, install scripts, telemetry, protestware, and more – 11 issues in all," it said.
This approach can also guard against more fraught commands like [18]npx and npm exec , which immediately execute downloaded code.
"Due to the prolific usage of these commands, we made sure to add protection for these commands too, so that you don't accidentally run bad code by copy-pasting an npx command from a README file or StackOverflow answer and get compromised," the biz [19]promised . ®
Get our [20]Tech Resources
[1] https://github.blog/2020-03-16-npm-is-joining-github/
[2] https://docs.npmjs.com/about-npm
[3] https://www.theregister.com/2023/02/22/open_software_supply_chain_risks/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZBOfmGbNPF8Pz@gi7T8TtwAAANI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://www.theregister.com/2018/08/22/npm_vulnerability_scanner/
[6] https://www.theregister.com/2021/07/09/npm_audit_security/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZBOfmGbNPF8Pz@gi7T8TtwAAANI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZBOfmGbNPF8Pz@gi7T8TtwAAANI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2022/03/01/socket_npm_dependency_scanner/
[10] https://socket.dev/npm/issue
[11] https://docs.socket.dev/docs/socket-cli
[12] https://socket.dev/npm/category/removed
[13] https://www.theregister.com/2022/03/01/socket_npm_dependency_scanner/
[14] https://www.theregister.com/2022/12/15/google_debuts_osvscanner_a_gobased/
[15] https://www.theregister.com/2022/03/24/developers_using_microsoft_azure_targeted/
[16] https://www.theregister.com/2023/02/22/open_software_supply_chain_risks/
[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZBOfmGbNPF8Pz@gi7T8TtwAAANI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[18] https://docs.npmjs.com/cli/v9/commands/npx
[19] https://socket.dev/blog/introducing-safe-npm
[20] https://whitepapers.theregister.com/
> the average npm package has 79 transitive dependencies
That's the fundamental issue. When you use a NPM package, you are running and deploying code made by dozens of distinct unaccountable entities. When I use, I dunno, a typical .NET library, usually if something goes wrong I can point the finger at the library vendor, or at Microsoft, and that's it. The surface for a supply chain attack is comparatively very limited.
I don't think that adding a scanner can do more than mitigate this problem a bit. Scanners and malware are always an arms race at best.
I wouldn't know how to fix the fundamental issue either. JavaScript just does not have a standard library worthy of the name, so you need a crapload of external libraries even to do comparatively basic things.
transitive trust
Is there is a fix for the fundamental issue? Developers always use more code from someone else than the code they write themselves. But there's a big difference in trust between an import statement and pulling in so many transitive dependencies you need code just to enumerate them. For my projects I stick with languages where import is enough. True that limits what I can accomplish, I can live with that.
"I don't think that adding a scanner can do more than mitigate this problem a bit. Scanners and malware are always an arms race at best."
Mitigating is good. We don't always get to choose our battles, but going into an arms race unarmed will lead to tears. So far this seems well done (although I won't be needing it). Hopefully it will continue to work after Microsoft inevitably buys it.
My npm safe word(s) are:
Avoid that messy crap at all cost!
It can be set up by running npm install -g @socketsecurity/cli
How many dependencies are pulled?