'No way to prevent this,' says only package manager where this regularly happens (kevinpatel.xyz)

by alligatorplum 72 comments 203 points
Read article View on HN

72 comments

[−] btown 1h ago
[−] aselimov3 59m ago
What are the actual guarantees that go/Rust make that Python/npm don’t? It seems like it might just be that Python/npm are juicier targets? I’m starting to try and avoid all third party packages
[−] p-e-w 1h ago
With the recent high-profile attacks on PyPI packages, it’s no longer true that npm is the “only package manager where this regularly happens”.

In fact, pip is much more dangerous than npm because it lacks a lockfile. uv fixes that, but adoption is proceeding at a snail’s pace.

[−] exabrial 58m ago
I really don't understand why the npm project cannot embrace PGP as ambulatory 'good enough' solution.
[−] qrush 1h ago
Look I despise supply chain attacks as much as the next person but it is ghoulish to compare these events to school shootings.
[−] mikepurvis 58m ago
I don't think it's comparing them directly or arguing for equivalent seriousness. It is identifying a similarity of mindset where those who have their hands on the levers of power that could materially improve the situation act like there's nothing they can do.
[−] rileymat2 1h ago
I read it as a comparison of the attitude of helplessness around it, not the acts themselves. So it was a bit meta, but unremarkably inoffensive.
[−] p-e-w 57m ago
You’re right. Major supply chain attacks affect far more people than school shootings do, and can potentially cost more lives through downstream effects.

It’s 2026. Software is critical infrastructure for global civilization now. Lives and livelihoods depend on it working reliably. The “it’s just bits on a computer” quip has been outdated for 20 years now.

[−] eranation just now
Sorry for hijacking threads like this again, and I know people have opinions about cooldowns etc. but cooldowns would save you from axios, tanstack, and many other recent npm supply chain attacks. If you work in a large company, you already likely have cooldowns via Artifactory / Nexus, and if you don't, it's easy to set up.

Why cooldowns? Most npm (or pypi) compromises were taken down within hours, cooldowns simply mean - ignore any package with release date younger than N days (1 day can work, 3 days is ok, 7 days is a bit of an overkill but works too)

How to set them up?

- use latest pnpm, they added 1 day cooldown by default https://pnpm.io/supply-chain-security

- or if you want a one click fix, use https://depsguard.com (cli that adds cooldowns + other recommended settings to npm, pnpm, yarn, bun, uv, dependabot and renovabot)

- or use https://cooldowns.dev which is more focused on, well, cooldowns, with also a script to help set it up locally

All are open source / free.

If you know how to edit your ~/.npmrc etc, you don't really need any of them, but if you have a loved one who just needs a one click fix, these can likely save them from the next attack.

Caveat - if you need to patch a new critical CVE, you need to bypass the cooldown, but each of them have a way to do so. In the past few weeks, while I don't have hard numbers, it seems more risk has come from Software Supply Chain attacks (malicious versions pushed) than from new zero day CVEs (even in the age of Mythos driven vulnerability discovery)

Disclaimer - I maintain depsguard.

[−] joeblubaugh 6m ago
There has been a lot of pain at my various jobs installing a safe global npm config on every developer machine, asking people not to disable it, checking it with mdm tools. A safer out-of-the-box configuration is long overdue.
[−] tkel 2m ago
Just dont use npm. Use a package manager which doesn't execute postinstall by default. The switch is incredibly simple.
[−] cluckindan 0m ago
Which package manager is that, and what caveats does it offer?
[−] timfsu just now
Pnpm - installs are faster to boot. We haven’t missed anything
[−] ricardo_lien just now
pnpm
[−] 827a 31m ago
There is no legitimate reason why postinstall scripts need to exist. The npm team needs to grow up and declare "starting with npm version whatever, npm will only run postinstall scripts for versions of packages published before ${today}".
[−] tkel just now
I audited several postinstall scripts recently in popular packages. They seem to be mostly around using native binaries, downloading them, detecting if the platform is compatible, linking to it directly instead of having it bootstrapped by node, working around issues in older versions of npm, etc. Since dev toolchains (e.g. esbuild) are now being built in compiled languages and distributed as binaries via npm registry. If you are on a recent version of node/npm and a common/recent OS/platform, you should be able to disable all the postinstall scripts legitimate issue.
[−] raggi 21m ago
install scripts are a distraction, just like package signatures are a distraction. adding/removing either feature has no significant impact on the wormability of this package ecosystem. installed npm code is run, with nearly zero exceptions.
[−] nine_k 6m ago
The installed code may be run in different settings, under a different user, with different privileges. Say, it may not run in CI/CD at all, or run only with the test user's privileges.

Postinstall scripts run at install time, with installer's privileges.

[−] piperswe 7m ago
A lot of it ends up bundled to run in a browser though, and doesn't end up running in Node.js
[−] throwaway27448 7m ago
Surely every layer of defense in depth is a distraction except the one that prevents the problem.
[−] amluto 2m ago
There is also not too much legitimacy to the fact that Rust packages can run unsandboxed when they build themselves.
[−] adamnemecek just now
I feel like it's harder to hide malicious stuff in Rust build scripts.
[−] Rohansi 23m ago
This doesn't really fix the issue though because package code is also executed at build time and during testing. Just maybe restricts the scope a little bit.
[−] tkel 3m ago
If you look at the last N npm worms, they all used postinstall scripts.
[−] cluckindan 1m ago
Is that even true?
[−] tkel just now
[−] cluckindan just now
So N=1? 2? 3?
[−] tkel just now
at least 3 that i can remember off the top my head in these last couple months
[−] guidedlight 6m ago
Security issues aside, they are a nightmare in enterprise environments where internet and OS access is heavily restricted.
[−] nine_k 12m ago
...and only if you invoke it with --dangerously-run-postinstall-scripts; otherwise it will report an error if a postinstall script is found.

This is definitely going to affect any packages that need to link to native code and/or compile shims, but these are very few.

[−] akoboldfrying just now
With respect, post-install scripts are a total red herring. You're alarmed by them because they are code controlled by someone else that runs on your box, and they could do something bad -- yes, they are, and yes they could.

But so is the regular code in those packages! It won't run at install time, but something in there will run -- otherwise it wouldn't have been included in the dependencies.

Thinking that eliminating post-install scripts will have more than a momentary impact on exploitation rates is a sign of not thinking the issue through. Unfortunately the issue is much more nuanced than TFA implies -- it's not at all a case of "Let's just stop putting the wings-fall-off button next to the light switch", it's that the thing we want to prevent (other people's bad code running on our box) cannot be distinguished from the thing we want (other people's good code running on our box) without a whole lot of painstaking manual effort, and avoiding painstaking manual effort is the only reason we even consider running other people's code in the first place.

[−] germandiago just now
I use C++ and Conan with my iwn recipes and pre-built artifacts.

This mitigates things to a great extent.

I do not know who thought that having your dependencies depend on the internet with a zillion users doing stuff to each package was a good idea for enterprise environments...

It is crazy how much things can get endangered this way.

[−] numbsafari 5m ago
It’s a mental health crisis, not a packaging crisis.
[−] brooksc just now
Thoughts and Prayers to those affected
[−] skeledrew just now
No surprise here. That's what you get when you have a language/ecosystem where core devs refuse to fix fundamental flaws, cuz for them breaking backwards compatibility is the worse crime that can ever be committed. And so all that happens in JS-land will eternally be layering lipstick on the pig in the cesspool. Too afraid of going through something similar to the Python 2 -> 3 fiasco, I guess because too many web devs and site admins would be incensed at being forced to fix their broken universe; as if it isn't already broken in its current condition.
[−] eulgro 15m ago
These satire articles on cybersecurity are really entertaining.

The other one a few days ago was also good: https://nesbitt.io/2026/02/03/incident-report-cve-2024-yikes...

[−] yegle 33m ago
Vendorizing using git submodule should be a robust mitigation for this problem.
[−] saghm just now
This feels like the modern analog of the king, the mice, and the cheese. What cats do I need to bring in to eat my git submodules?
[−] raggi 17m ago
subtree is better for this case, you want to encourage actual reading before running. reading won't catch everything but it catches a lot, and the burden isn't as high as people always complain about before they try it.