Major bank accidentally published a private package to the public NPM Registry
twitter.com
twitter.com
What it did was ask me to "log in" (there was no prompt to sign up), which I did with our internal credentials. It also asked for an email address, which in retrospect was foolish of me to provide, but that was the only indicator that something was not right. It did not tell me where I would be publishing to.
When it was done it said the package was published. I checked the internal repository and it was not there. Instantly felt that horrible feeling in my stomach that everyone knows. I went to npmjs.com and found out that it had helpfully created an account with the internal credentials I provided, the credentials that were given in a prompt that said "npm login".
What saved me was that the package was inside an organisation ("@foo/bar") and those are not free on NPM, so the package was not published, even though Yarn said so. The user account was created, though, so I had to recycle that password and send email to NPM support to get the account deleted (there is no way to delete your account yourself, sadly).
The moral of this post is that when I saw this tweet I did not laugh at the company's foolishness in publishing internal code on NPM, because I almost did that myself and saw how easy the mistake is to make. (Of course, the rest of the tweet with the DMCA stuff is foolishness.)
(Public) Orgs _are_ free on NPM (at least nowdays) so maybe even that wouldn't have saved you.
For the original tweet's company, there was probably some kind of incompetency involved in not noticing that the code was public for years. But I can't comment on that further as I don't know the circumstances. I only wrote my anecdote about the accidental publishing side.
It's an easy mistake to make. What is concerning is that the bank didn't notice for three years... I feel like that should have been caught a lot sooner.
Explicit vs. Implicit : always choose explicit if accidents can cause people serious pain. npm login that is secretly npm "create account" is a serious anti-pattern. And npm publish -> npm login -> npm create account is a consequence of that.
Also, a .rc file (package manager chosen by the team) with a private registry that refuses to publish unless done automatically by the pipeline set in the root of every project.
The only reason I find it understandable how it could happen at a major bank (these days, they should have a sizeable team that takes care of security measures like I described) is that this was 3 years ago. Publishing to private registries was relatively new back then, so people didn't have proper publishing workflows yet.
I mean... I guess mistakes can still happen. But on a scale of 1-10, I would find such a mistake far less excusable today considering the circumstances. Small, inexperienced team, maybe constant deadline pressure - more excusable. Duh...
This is how we do it. Publishing is locked down to specific service accounts, with credentials set up in a CI environment with locked down build configurations. Publishing to the internal registry is not possible unless you have these credentials, and you don’t. There’s a whole process for retrieving keys. Publishing to the internet isn’t possible due to a firewall just killing those requests dead. You could probably do it via a proxy, but you’d break your contract and probably be fired if not worse.
People complain about the locked down build configurations, until they need help at which point standard build configurations mean they actually get support, as opposed to “good luck; have fun!”
Source: I work for a major bank. (Presumably not the one this story is all about!)
I can't possibly see how they would possibly have any case.
When governments fail to redact documents, it’s on them.
If you “accidentally” talk to a reporter about your solicitor-privileged comms, it’s not privileged anymore.
If you don't have a license from the copyright holder, you can't legally use it, except for fair use exemptions: perhaps you could write a blog post criticizing it.
The few exceptions are where copyright essentially doesn't exist at all. Where it does, this is how it works.
What about public domain works for example? Or you had a good faith belief you had permission from the copyright holder, eg someone misrepresented themselves as the copyright holder, or the copyright holder published the code in public without a copyright notice?
Buying a Rolex from some guy in a car park is different to buying one from a jewelers. The former wouldn't protect you in any way, the later would let you demonstrate a good faith belief that it wasn't stolen, and wasn't fake.
More generally, say if wanted consumer protections consistent with it being a Rolex, or if you wanted to sell it as a Rolex. Then whether you bought it as a fake does matter.
Good faith: that may affect the amount of damages the copyright holder can extract, but it's still illegal to use the software.
Copyright notices: haven't been required for 30 years.
My underlying point though was that it was an unreasonable answer, to just copy paste the previous answer. No one here that I've seen has claimed to be a lawyer, and no one I've seen has defined what nations laws we are talking about. At that level of discourse, the question posed, deserved a reasonable answer.
Nope, only on works published over 30 years ago. This package was published only three years ago, regardless of when it was created.
There really isn't much nuance under the copyright rules almost universally agreed under treaties like Berne, UCC and TRIPS. This kind of what-ifing a clear statement just sounds like a bad movie trope.
And if you get enough money and lawyers in one place you can create plenty of nuance.
Dragonwriter reminded me of the term, implied licence in another subthread. That clearly seems arguable in this case even if it isn't considered winnable. Case law progresses through winning 'unwinnable' cases.
I think we're approaching this from completely different positions though. I appreciate the what-ifing, exploring the hypotheticals. It isn't as if we have any power to make a difference in a court of law, and I would hope no one is relying on this thread for legal advice.
If Coca Cola writes down its proprietary recipe on their entrance "by mistake", I can definitely make use of it. Maybe I can't photocopy it for sale, but I can definitely re-use their previously-secret techniques.
I can even say I got it from them through their own error and have the exact same outputs for the exact same inputs.
Trade secrets aren't your secret anymore once you publish them.
All we know in this case is that copyright law was used as a tool to remove it.
Courts strongly disagree with you.
If you reverse engineer a system and write a spec using clean-room technique, it's going to be massively easier for the team to do it if they have lawful access to the no-longer proprietary source code.
And wouldn't that be the method to re-create your own copyrightable implementation of GPL code too?
If you're saying any country where they don't respect it in practice, then sure.
USPTO explanation of difference between a Patent, Copyright, and Trade Secret.
Surely this depends on the terms under which they uploaded it. I would expect npm to have a legal structure in place under which code you upload for public use is also licensed for public use.
Not how it works. For example, see the license field here:
NPM doesn't appear to have a "default license" though, so that would be "no license", therefore normal copyright law would seem to apply, and you can't make a copy of it, and more than you can copy a picture on a billboard or a blog post or whatever.
I'm not sure a car is the best comparison though.
How about a restaurant putting mint imperials by the cash register. Is it legal for patrons to take one?
Mints are put out explicitly for you to take. Property right intentionally transferred.
Same for any lost property, if you find something valuable (wallet full of cash), you generally have to turn it in to the police, and there is a notification process to try to find the owner, and after a period of time (generally 3 months), if no one has claimed it, it's yours. Again, local laws are going to differ, but the general legal concept, that "A finder of property acquires no rights in mislaid property, is entitled to possession of lost property against everyone except the true owner, and is entitled to keep abandoned property."[1] is common.
There's some old saying about possession being 9/10ths of the law....
[1] https://en.wikipedia.org/wiki/Lost,_mislaid,_and_abandoned_p...
Of someone leaves a car on my drive I can do something about it, you may not be able to do in your territory. I'm surprised there isn't the a legal concept of abandonment though, what do you do if someone drops an empty can on your land?
I'm not sure what all rights (physical or otherwise) might be applicable here.
AFAIK, you can selectively (or not at all) enforce copyright all you want and then change your mind later.
Are you thinking trademark rather that copyright? I'm not sure you can fail to adequately protect a copyright in that sense.
This is not true. Not even remotely true. It is routine that a company notices someone using their copyrights after decades and then sues about it. Oracle is suing Google over code that was "unprotected" for a decade before they decided to sue. In Australia (I know, different country, but this is the same), Men at Work were successfully sued 29 years after they released "Land Downunder" because it has a two bar riff with similarity to a song written in 1928 [1].
As a side note, I see this all the time. What is it about this particular topic that people seem to (a) consistently confuse these things but more importantly (b) feel confident enough about ti to repeat the confused viewpoint with certainty to others?
You are probably thinking of trademarks.
Or something to that effect. Or maybe companies can just pony up for NPM Enterprise which fits their use case.
Later, once you have most needs filled by packages, and a good number of enterprise users, more control is beneficial. Companies appreciate it, and single users are willing to jump through an extra hoop or two much of the time because the rest of the ecosystem is so useful that it's not worth switching languages.
I think it's unlikely that a system will move from one style to another without an event causing them to reevaluate their prior choices. More likely, multiple events. This has already happened with NPM for other choices they made in the past, such as letting package namespaces be claimed by new people after someone gives it up, and whether releases are immutable, IIRC.
Why not install `com.facebook.react’? Reverse domain notation is remarkably elegant given our internet. You are not typing ‘npm i com.facebook.react’ so often that it’s a pain. You probably use ‘create-react-app’ which is even worse.
Instead, every language creates a new cash grab for common names. And made it worse. New namespaces, new squatting. I can publish ‘react-racket’ and do whatever I want behind the scenes with it.
Case in point: do you add coffeescript or coffee-script.
Why optimise for keystrokes in your term instead of stability for your client? Jesus fuck.
A whole quarter of a century, or perhaps half of the entire software industries lifetime, of exciting known security errors to look forward to!
BRB, off to hide all my bitcoin under my mattress...
That would be a bad idea, and it's not just brevity.
- If com.facebook.hr has previously been published, would it mean that facebook can never have a division named HR?
- Once a company goes belly up, the domain often ends up with squatters/spammers. Domains with published packages will sell for a lot more in the underground market - for pure exploitation of rights to publish a newer version.
- In the absence of validation, nothing stops anyone from publishing com.google.exploitlib. And domain validation is friction.
- Most publishers on npm may not have a domain.
And finally like someone mentioned below, npm already supports scoped packages. https://docs.npmjs.com/about-scopes
This is such a solvable problem.
Doesn't package.json have an is private repo flag? Why not just respect that?
Why does everyone everyone in this thread think a pop up is the solution?
Pop ups are a code smell. They mean your application does not correctly match user intent with the action so badly you had to specifically get your user to tell you what they meant to do. Did you mean to do that? Always, yes. Otherwise, undo.
The only place did you mean makes sense is in Google search results.
Why is public and private publish anywhere near each other? Why are they even on the same page?
Stop drawing boundaries around nouns.
It doesn't necessarily have to be a pop up popup per say, but extra validation around dangerous actions is user friendly.
And of course there can always be an override for the extra validation in case it potentially screws up some people's workflows, but I'd make a user explicitly set the override, like the 'NoHostAuthenticationForLocalhost' option in ssh for example.
If the user hacks around that, it's their own fault.
I don't think a popup solving a problem means it is solving the right problem in the right way.
npm does reflect that flag. If you set private in package.json, npm won't publish it publicly. From docs:
> private
> If you set "private": true in your package.json, then npm will refuse to publish it.
> This is a way to prevent accidental publication of private repositories. If you would like to ensure that a given package is only ever published to a specific registry (for example, an internal registry), then use the publishConfig dictionary described below to override the registry config param at publish-time.
Make it so you have to explicitly go in and mark your package.json as public before npm will publish it, and have the default be private?
I don't have _too_ much sympathy for the bank here - it's in npm's best interest to make it easy to publish leftpad.js easily <snarky smirk> - and that probably should be their default stance.
The bank should be responsible for ensuring their "banking grade security" includes not accidentally publishing their source code to public repos. (How much would you bet against there being instances exactly like this where the publication vector was GitHub instead of npm? How much would you bet against this exact code being on a public git repo somewhere as well? How many public code hosting services should be expected to change their business models because some bank gets uptight after they've fucked up?)
Some bank developer (or more likely, some underpaid contractor) wants to share something between projects and doesn't want the hassle of proper channels, or just doesn't care enough and thinks "I'll publish this, who will ever find it?".
Years later someone stumbles upon it, maybe they don't even know who did it, "NPM why do you have our code?!?!?!?!"
This is the most likely scenario once you consider this was a bank. In which case there's nothing NPM could do. No warning would have changed their intent, they knew what they were signing up for.
That's what I was getting at above. It definitely was in NPM's best interest to do so. Depending on your definition of "easily", is it still in their interest to have it quite that easy? Perhaps a different default is in order now, as you suggest. Or perhaps it should even require a confirmation dialog on the terminal for the first public push? People will still use NPM at this point. Not having enough packages or a package for a specific functionality is hardly a problem for them any more.
Then libraries could simply add an npm script for publishing.
npm publish
To publish a package to
npm, you must enter:
npm publish npm <package-name>
To publish a package to
another registry, you
must enter:
npm publish <url> <package-name>
At the end of the day, there's only so much you can do. Really, a hammer shouldn't have a prompt on it confirming each hit. If it does, users will just instinctively press it and then a few months down the road they'll hit their thumb.
Ever tried installing a local package via a file path? NPM just symlinks it into node_modules, causing issues because you suddenly have duplicated dependencies. Yarn does the same, btw.
I have given up any hope regarding npm/yarn acting sensible long ago.
https://github.com/yarnpkg/yarn/issues/5310
oops
Not a rule. Do you really want undoable actions like "Delete" to just delete in a touch operated interface?
That said, I fully support a terminal level confirmation the first time something is pushed publicly in any package manager. It is absolutely the correct thing to do to add safeties to a process that is irreversible and can have negative consequences. Often enough, making anything public online is irreversible, and making something public that wasn't ever supposed to be can have negative consequences in many respects.
But what I was really thinking of when I was typing my original comment was moving to a system where someone actually approves new package publishing accounts and or some subset of package namespace requests. Systems that start without any sort of moderating or approval process seem to eventually settle on one. The reasons for this are numerous, from security to just keeping people from overwhelming the more common or sought after names and general sanity checks (does a system really need to allow separate packages for a term where one is singular and one is plural? Who does that help?).
> "it looks like your package might have a private key in file xyz.js on line 27. Please type "no it doesn't" into the box below if you're sure this is not the case".
Publishing software is not a security violation in greater than 98% of cases. The only valid exceptions are protections of trade secrets and cryptographic information.
I am not counting software with embedded credentials, embedded business data, or other bad practices. Those are security violations regardless of public exposure.
Trying to explain this to security sensitive organizations is painful. I am confident in the stupidity of this conversation as somebody who has been writing code for more than 20 years and passed the CISSP exam the first time back when it was a 250 question paper test.
Then there is always that part of the organization that isn't judicious about keeping packages up to date, and these kinds of package exposures expose their negligence.
Then there is the other piece of my systems being dependent on your systems in a sometimes inappropriate matter if precautions aren't taken. 'Oh I just added this dependency' is a quick way to an outage if rules aren't set.
Agreed, but that is not a publication problem. That is a separation of concerns violation which indicates a host of other problems from the lack of code review to incomplete security testing to various ad hoc or integrity violations.
External systems have no bearing on the validity and completeness of your organizations internal security controls. It doesn't matter how incomplete, insecure, or unqualified NPM is to serve a given set of code. The problem isn't NPM or the publication to NPM. The problem is the contents that comprise the publication in question. A good security audit would ask why any certain content is available for publication in violation of internal policy regardless of what that content is.
For example if you accidentally publish to NPM code containing a bunch of user PII the problem is why PII was resident in the code in the first prior to publication. The fact that such PII is exposed is now a different second problem demanding a different resolution. You could make the argument that halting and regulating all publications would solve that problem. That is incorrect, because the PII is still exposed within your organization outside of a controlled environment and can still be leaked to the public by various other means.
> Then there is always that part of the organization that isn't judicious about keeping packages up to date, and these kinds of package exposures expose their negligence.
That is dependency management whether or not you own the packages in question. Dependencies need to be appropriately managed for a variety of security reasons. Exposing poor dependency management advertises a vulnerability, but the vulnerability is there anyways and a dedicated malicious attacker will exploit it the same either way.
---
The bottom line is that hiding your security problems by "not publishing" is not a valid security control. That is the dreaded security by obfuscation and it works both ways. By hiding the vulnerability you also hide the exploitation from visibility.
I ask for regex only because our corp proxy binds to a random port reach time it runs so a static string wouldn't be flexible enough.
Took a while for Ruby to get it but for the last 5 years you have default config for self-hosted sources whenever you make a new gem.
Of course, npm is unique in being privately funded. It doesn’t want you doing that.
Benefit of the doubt says that they thought they were publishing privately.
Going back to Ruby, you will fail a bunch of CI steps just by leaving defaults in place.
You're likely thinking of bundler's source, but even then that doesn't apply to publishing a gem.
In what world is pushing your source code to a venture backed (therefore viral growth oriented) company who promote themselves with "npm Inc supports the JavaScript community by providing the registry where developers publish and share packaged open-source modules" possibly consistent with a view that "they thought they were publishing privately"???
Sorry, but I just don't buy that.
Somebody at the bank fucked up. It cannot possibly be npm Inc's responsibility to detect and somehow police that.
Or a little more radical, why even bother with the lawyers? You can explain to them how it is, and if they won't listen, they can sue you. Then you spend some lawyer costs, they lose because the whole thing is ridiculous, and you get a 'cost conviction' or 'cost order' as we call it (kostenveroordeling, where you pay the winning party's costs to prevent abuse of the system) so they pay your lawyer.
I had also reached out to our client contact. They contacted the CMS company, provided them with the license information, and then switched to another CMS.
He was also concerned that we were letting people 'View Source' our web pages and stealing our IP.
...and here is where the DRM advocacy comes in. Don't let them ruin the Internet...
Just sayin.
The problem NPM solves isn't a particularly interesting or challenging problem to solve if you don't try to solve it at scale. They'd just build their own. Then for the couple of packages that are hard to replicate, they'd find a way to sign some papers to get access to the code and push it to their own registry. For everything else they'd just rewrite it from scratch. Short of things like React, it's not all that hard for places with the resources of these big corps to rewrite bundlers, web servers, and utility libraries.
So, good job.
Not only do you get additional security for 2FA, you also get a prompt for the TOTP pin that makes you question what and where you’re publishing.
Surely in a bank, when publishing, the decisions aren't down to a single dev. Either many people made a mistake together or many people made lots of small mistakes separately that added up to one big one??
FWIW, I don't know, I'm a small time potter, just how I imagine things happen in banks (I do know a couple of devs who work/worked for banks).
You might not even know that this happened. Mysteriously, a clone company pops up, or a competitor seems to know all your contract negotiations and customers.
Another possibility is that a lawsuit over data leakage takes out the company. Sometimes reputation alone can kill a company.
BTW, it's really pessimistic to suggest that an air gap would kill productivity. It isn't that hard to physically transfer files from the computer at your left to the computer at your right. The disconnected network can have copies of popular software repositories, including for your OS to get updates.
Source: https://twitter.com/seldo/status/1105157348560007168?s=09
It’s certainly true that some security practices within our organization seems more like security theater than anything else, but overall I think they have pretty reasonable standards and requirements set. It is very true though that the culture is almost entirely focused on compliance more than anything else, so there’re few proactive measures taken by teams. Lord knows no team I’ve ever seen outside of security wants to budget for it. Maybe it’s a damned if you, damned if you don’t kind of situation. If you don’t set compliance regulations you’ll get no security (move fast and break things, yay!) but if you do you end up with people ticking boxes saying “the thing is secure and stuff yo” and then play the blame game when it isn’t.
My feeling though, having worked with top tier banks in the financial industry for the last 8 years or so, is that more people are competent than not, but process stifles creativity and drive a lot of the time. It’s a very special kind of environment to work in.
"Stupidity" is having ignorance about a field but pretending not to.
These lawyers may have 7 years of law school education, but they are still "stupid".
What stops someone from creating that account and owning that org?
npm install goldmansachs
Maybe $35/byte. Then the lawyers could haggle, get it reduced to $35/non-white space byte, and feel like they accomplished something.
If someone finds a module of BankX's boring backend code, what is the risk/problem for the bank?
Another thing is the code itself, you don't want competitors seeing your implementation if you feel that it gives your company an advantage over others. There may be data structures or algorithms that are internal company knowledge only and defined in the code.
Tweet thread says it's a react packaged which means it's probably usually transpiled and minified, so not technically available in its original form in its distributed application.
I was upset about it when it was introduced, but now I start to see the point...
SMH.
This bank uploaded their own code to the repo, and when they found it they didn't bother to do any investigating before they started sending legal demands.
It was 100% their responsibility to ensure that they were not responsible for their own leak before they started making legal threats.
They decided to skip due diligence, and they should pay the price for wasting others' time and energy, regardless of their "intentions".
Thus, a DMCA request is appropriate, as the GP points out, the original employee that did the action quite likely cannot undo that action.
That said, that relates mostly to vanilla contract and agency law. Copyright law can add its own twists.
Still, that doesn't mean they can be bound by a license granted by an unauthorized employee. I think at most they would have to pay damages, if any.
> (From npm tos) Your Content belongs to you. You decide whether and how to license it. But at a minimum, you license npm to provide Your Content to users of npm Services when you share Your Content. That special license allows npm to copy, publish, and analyze Your Content, and to share its analyses with others. npm may run computer code in Your Content to analyze it, but npm's special license alone does not give npm the right to run code for its functionality in npm products or services
Private npm repositories are an entirely different beast, and like GP mentions, there is no great option here.
EDIT - I see what you are saying - your own registry with browser and all.
That includes tarballs on http, git repos and even freaking local directories.
For companies where putting packages on smb mount is treated as non-enterprisey, npm have "npm enterprise" offering: https://www.npmjs.com/products/enterprise