Liran Tal

Developer Advocate at Snyk

Malicious Modules on npm

A Series of Unfortunate Events

@liran_tal
@liran_tal
github.com/lirantal

Liran Tal

Developer Advocate

npm's Heavy reuse

Spring web framework

10 transitive dependencies

Express web framework

47 transitive dependencies

src: https://snyk.io/opensourcesecurity-2019

The Biggest Repository

Invites big risks

Lucrative attack playground

Open and free-to-publish ecosystem

Difficult to counter-measure

- Disconnect between SCM and Registry

- Commiter !== Publisher

676,539 packages for 199,327 maintainers

stat of the day

~4.5 packages/maintainer average ratio for 2018

@liran_tal

stat of the day

a small, linear increase in direct dependencies leads to a significant, super-linear increase in transitive dependencies

@liran_tal

stat of the day

transitive dependencies of an average package has increased to a staggering 80 in 2018

@liran_tal

stat of the day

the red line shows that in 2018, about 24,500 packages have reached at least 10 other packages

@liran_tal

some popular packages reach more than 100,000 other packages via
direct or transitive depenencies

stat of the day

the red line shows that in 2018, about 24,500 packages have reached at least 10 other packages

@liran_tal

event-stream reached 5,466 packages when it was compromised and it's not even considered "top" influence

stat of the day

@liran_tal

to adjust to devDependencies which event-stream targets, its reach is now computed at 100,000 other packages, only 347 packages far from the top

stat of the week

@liran_tal

for the majority of the time the reach of vulnerable unpatched code is between 30% and 40% is alarming.

stat of the week

@liran_tal

a sign of a healthy security community that reports vulnerabilities at a very good pace, keeping up with the growth of the ecosystem

(Zimmermann, Staicu, Tenny, Pradel, 2019)

http://software-lab.org/publications/npm_study_arXiv_1902.09217.pdf

Typosquatting Attacks

Compromised Accounts

Social Engineering

Malicious Modules

Malicious Modules

time

Jan 2015

rimrafall

rimrafall

research paper

Installing an average npm package introduces an implicit trust on 79 third-party packages and 39 maintainers, creating a surprisingly large attack surface

Malicious Modules

time

Jan 2015

rimrafall

Jan 2017

crossenv

$ npm install crossenv --save

crossenv    !=   cross-env

crossenv/package.json

crossenv/package-setup.js

coffescript      or      coffe-script 

coffeescript

src: https://snyk.io/vuln

How did we find out about this malicious crossenv package?

post-install script ✅

call-home base64 payload ✅

research paper

Highly popular packages directly or indirectly influence many other packages (often more than 100,000) and are thus potential targets for injecting malware.

Malicious Modules

time

Jan 2015

rimrafall

Jan 2017

crossenv

May 2018

getcookies

getcookies

parse http headers for cookie data

or does it... ?

getcookies

http-fetch-cookies
                └── express-cookies
                                        └── getcookies

 

getcookies

mailparser                               

    └── http-fetch-cookies
                └── express-cookies
                                        └──getcookies

 

Reset the buffer

Load JavaScript code

Execute code

Observation 1

security by code review has to be on-point ALL THE TIME, where-as attackers only have to get lucky ONCE

Malicious Modules

time

Jan 2015

rimrafall

Jan 2017

crossenv

May 2018

getcookies

Jul 2018

eslint-scope

eslint-scope 3.7.2

malicious package published

What's going on?

Who depends on eslint-scope?

babel-eslint

eslint

webpack

npm invalidates all tokens

<= 2018-07-12

 

estimated potential ~4,500 accounts  were compromised 

Observation 2

eslint-scope published an npm package, but actors had no github repository access so the source code varied between github and the published npm package

How does something like this happen?

Compromised Contributors ?

14%

compromised npm modules

Compromised Contributors ?

src: https://github.com/ChALkeR/notes

Compromised Contributors ?

20%

npm total monthly downloads

express

react

debug

moment

request

Compromised Contributors ?

Compromised Contributors ?

662

users

123456

had their password set to

Compromised Contributors ?

Compromised Contributors ?

1409

users

had their password set to

their username

Compromised Contributors ?

Compromised Contributors ?

11%

users

had their password set to

previously leaked password

Compromised Contributors ?

Malicious Modules

time

Jan 2015

rimrafall

Jan 2017

crossenv

May 2018

getcookies

Jul 2018

eslint-scope

event-stream

Nov 2019

src: https://snyk.io/blog/a-post-mortem-of-the-malicious-event-stream-backdoor

Observation 3

due to the increased use of transpilers, reviewing and comparing source code between actual source to distributed is a real problem

Dependency Management

(CC BY-NC-SA 2.0)

Common Security
Vulnerabilities

Command Injection

The npmjs Ecosystem

Silver Linings in
Node.js Security

react-native

reactnative

rea-ct.native

react_native

   @lirantal/rea-ct.native

Fighting Typosquatting

Package Moniker Rules

Fighting Typosquatting

JSONStream    !=    jsonstream

Package Moniker Rules

Package Publishing Notifications

Enable 2FA
since npm >= 5.5.1

$ npm profile enable-2fa

2FA successfully enabled. 
Below are your recovery codes,
please print these out. 

- auto release ?

- tokens are global for all packages

- npm recommends creating a 2nd user

Enable 2FA
caveats 😞

Devs Take Ownership

for App Security

Source: The State of Open Source Security Report 2019, Snyk

https://snyk.io/opensourcesecurity-2019/

Find vulnerabilities in
open source dependencies

What if security was easier?

What if security was actionable?

Node.js Security Working Group

Silver Linings in
Node.js Security

The Security WG

The Security WG

Improving the state of Node.js Security

Incident response for Node.js core and the npm ecosystem

Security disclosure policies for bug hunters

Maintain a public vulnerability database

The Security WG

Uninitialized Buffer

base64url

|

2,000,000

|

XSS Injection

react-svg

|

130,000

|

Path Traversal

serve

|

564,000

|

ReDOS

protobufjs

|

7,200,000

|

monthly downloads

01

Malicious modules & compromised accounts

02 

|

|

03 

|

Common Security Pitfalls in Node.js

Developer awareness,
Fix vulnerabilities in your open source libs,
Node.js Security WG

Black Clouds & Silver Linings
in Node.js Security

|

|

@liran_tal
github.com/lirantal

Liran Tal

Developer Advocate

Use Open Source, Stay Secure.
Thank you!

Malicious Modules on npm - A Series of Unfortunate Events

By Liran Tal

Malicious Modules on npm - A Series of Unfortunate Events

With a great ecosystem, comes great responsibility, and application security is not one to wave off. Let’s review some black clouds of security horror stories in the Node.js ecosystem, and learn how to mitigate them to build secure JavaScript and Node.js applications. We will deep-dive into practical Node.js security measures which you can easily implement in your current projects, covering OWASP Top 10 issues such as injection attacks and secure dependencies management. Finally, we will review the work and initiatives that the Node.js Security Working Group have been taking to ensure a more secure future for Node.js.

  • 1,104