Hacker News Reader

Comment by tabwidth | Hacker News Reader

Most of the malicious ones just curl something in a postinstall script, scanners already catch that. The sneaky ones don't look malicious until they run, and three days may not help.

View on HN

There are plenty of ways to notice a malicious release without observing it running.

Build provenance, maintainer alerts on new releases, tying releases to specific git tags, etc all help.

Every single one now will be more sneaky, and we’ll be operating on a 3-day cooldown for no reason.

You really think it has zero benefit whatsoever? Nothing malicious will be caught?

Pretty much. These tools are effective now only because the malware doesn’t have to avoid being detected at all to be successful.

How exactly does that work?

I don't think that HNers understand the recent supply chain attacks very well at all. I also don't think they realize the tests the SCA/package providers do to all the major packages.

Almost all these attacks try to reach out to external sites to steal your data. That is exceptionally hard to hide in any meaningful way.

    def steal_your_data():
      if datetime.now() < three_days_after_attack:
        return
      reach_out_to_external_sites()

OK, so it looks like you've still added suspicious code to your package.

You can make it much less suspicious. In particular, if you can compromise the package publishing process, and not just pushes to main, you can add your malicious code to binary artifacts, not to the source code.

That’s a bold claim to make about HNers. Au contraire, security companies have absolutely missed supply chain attacks.

Example:

https://snyk.io/blog/node-gyp-supply-chain-compromise-self-p...

Before that we had event-stream, then we had XZ compromise.

It’s not exceptionally hard to delay reaching out to external sites until after a cooldown period.

Reply on news.ycombinator.com