<commit_before># Containednpm

There is an [npm worm vulnerability](https://www.kb.cert.org/vuls/id/319816). One of the main problems is that random scripts are run with full user privilege.

This repo provides a proof that secure user-contributed scripts is possible. It's a POC and does not pretend that the used implementation is shippable as is. Additional work would be required for this idea to be integrated to the official npm CLI client.


## How it works

`containednpm` is an npm drop-in replacement running inside a [Docker](https://www.docker.com/) containers with reduced authority by default.


## Setup

A bunch of things to install before the POC work

* **Install** [Docker](https://docs.docker.com/installation/#installation)
  * On Ubuntu, there is an [apt repository](https://docs.docker.com/engine/installation/ubuntulinux/)
    * (for steps 5 to 7, do `echo "deb https://apt.dockerproject.org/repo ubuntu-trusty main" > /etc/apt/sources.list.d/docker.list`)  

* **Install** [Docker compose](https://docs.docker.com/compose/install/)

````sh
git clone git@github.com:DavidBruant/contained-node.git
cd contained-node

# change the PATH only for this shell session
PATH=$PWD/bin:$PATH

# Install nsenter and docker-enter from https://github.com/jpetazzo/nsenter by doing: 
docker run --rm -v /usr/local/bin:/target jpetazzo/nsenter

````



## Defense POC

:warning: **This only works on Linux for now. It's certainly possible to have it work on Windows and Mac, but that's for another day**


````sh
cd project-alpha
cat package.json
npm install https://github.com/DavidBruant/harmless-worm --save
cat package.json
# Notice that package.json has been modified by a lifecycle script :-(

# reset to non infected state
cd .. 
git checkout project-alpha

# Build the dindnode image (it's a long step because node is compiled)
docker build -t dindnode .

docker-compose -f contained-services.yml run -d --name containednode containednode
docker exec containednode docker pull mhart/alpine-node:5

./bin/containednpm -v # running npm via the container
<commit_msg>Moving to setup what belongs there<commit_after># Containednpm

There is an [npm worm vulnerability](https://www.kb.cert.org/vuls/id/319816). One of the main problems is that random scripts are run with full user privilege.

This repo provides a proof that secure user-contributed scripts is possible. It's a POC and does not pretend that the used implementation is shippable as is. Additional work would be required for this idea to be integrated to the official npm CLI client.


## How it works

`containednpm` is an npm drop-in replacement running inside a [Docker](https://www.docker.com/) containers with reduced authority by default.


## Setup

A bunch of things to install before the POC work

* **Install** [Docker](https://docs.docker.com/installation/#installation)
  * On Ubuntu, there is an [apt repository](https://docs.docker.com/engine/installation/ubuntulinux/)
    * (for steps 5 to 7, do `echo "deb https://apt.dockerproject.org/repo ubuntu-trusty main" > /etc/apt/sources.list.d/docker.list`)  

* **Install** [Docker compose](https://docs.docker.com/compose/install/)

````sh
git clone git@github.com:DavidBruant/contained-node.git
cd contained-node

# change the PATH only for this shell session
PATH=$PWD/bin:$PATH

# Install nsenter and docker-enter from https://github.com/jpetazzo/nsenter by doing: 
docker run --rm -v /usr/local/bin:/target jpetazzo/nsenter

# Build the dindnode image (it's a long step because node is compiled)
docker build -t dindnode .

docker-compose -f contained-services.yml run -d --name containednode containednode
docker exec containednode docker pull mhart/alpine-node:5

./bin/containednpm -v # running npm via the container

````



## Defense POC

:warning: **This only works on Linux for now. It's certainly possible to have it work on Windows and Mac, but that's for another day**


````sh
cd project-alpha
cat package.json
npm install https://github.com/DavidBruant/harmless-worm --save
cat package.json
# Notice that package.json has been modified by a lifecycle script :-(

# reset to non infected state
cd .. 
git checkout project-alpha

{'fraction_non_alphanumeric': 0.10088453263208223, 'fraction_numerical': 0.004303131723643318, 'mean_word_length': 4.178217821782178, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 5, 'https://': 16, 'lorem ipsum': 0, 'www.': 4, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6999802', 'n_tokens_mistral': 1311, 'n_tokens_neox': 1185, 'n_words': 489}