<story><title>NPM Package Hijacking From the Hijacker&apos;s Perspective</title><url>https://medium.com/@nm_johnson/npm-package-hijacking-from-the-hijackers-perspective-af0c48ab9922#.9jhs5aff4</url></story><parent_chain></parent_chain><comment><author>api</author><text>Security in a complex interdependent software ecosystem is untenable.&lt;p&gt;Period.&lt;p&gt;NodeJS&amp;#x2F;npm is in no way unique here. Apt, yum, gem, Homebrew, Docker hub, etc. are just as bad if not worse, not to mention &amp;quot;git clone&amp;quot; followed by &amp;quot;.&amp;#x2F;configure&amp;quot; or &amp;quot;make.&amp;quot; Any time you bring down code onto your machine and execute it you are... well... bringing down code onto your machine and executing it.&lt;p&gt;I&amp;#x27;ve been increasingly thinking that this could be a very fertile area for AI research. Security is really an AI hard problem. There is no combination of sandboxing, permissions, auditing, formulaic static code analysis, firewall hacks, etc. that will yield a system that is both (a) usable&amp;#x2F;convenient and (b) secure.&lt;p&gt;Take &amp;#x27;npm&amp;#x27; for instance. It&amp;#x27;s amazingly convenient but it (and all other packagers like it) is a security nightmare. Operating securely would require one to set up a shadow mirror of the entire NodeJS ecosystem and then have someone ($$$$$) manually audit &lt;i&gt;every single thing in there&lt;/i&gt; that you are going to use and &lt;i&gt;every single change&lt;/i&gt; that comes down from above. That&amp;#x27;s not tenable for anyone but the most lavishly funded organizations, and anything like that is universally reviled by developers since it slows them down. I&amp;#x27;ve worked in environments like that before (government), and we had people quit because it was just &amp;quot;impossible to do my work.&amp;quot;</text></comment>
<story><title>NPM Package Hijacking From the Hijacker&apos;s Perspective</title><url>https://medium.com/@nm_johnson/npm-package-hijacking-from-the-hijackers-perspective-af0c48ab9922#.9jhs5aff4</url></story><parent_chain></parent_chain><comment><author>jwcrux</author><text>I&amp;#x27;m not a JS dev, but would it be possible for a malicious actor to create a pre&amp;#x2F;post install script that looks for packages published by the current user and &amp;quot;worms&amp;quot; its way into those pre&amp;#x2F;post install scripts?&lt;p&gt;If this were possible, something like this could have the potential to infect quite a few npm modules.</text></comment>