Supply Chain Attacks

It can have supply chain attacks like npm... That high quality library system is also a liability.

The npm supply chain attacks (or any similar ones) are essentially the same issue described in the article. You can't trust 3rd-party provided code implicitly. Even if the code is initially fine it's subject to change in later revisions. This issue goes all the way down the stack. Obviously, with a large user base the likelihood of quick detection goes up, but the issue never goes away.

Yes. The crucial issue to me is the increasing frequency of attacks where some piece of open source gets an update - leading to endless hidden supply chain attacks.I don't see anything that is going to block this from getting worse and worse. It became a pretty common issue that I first heard about with npm or node.js and their variants, maybe because people update software so much there and have lots of dependencies. I don't see a solution. A single program can have huge numbers of

npm audit reports known vulnerabilities, but I think it doesn't help against supply chain attacks, or does it?

> It doesn't just download random things.That's exactly what it does. The developer is not really expected to thoroughly review the codebase of every dependency.Just like javascript, all sort of supply chain attacks are made possible.A single malicious library can sneak into large ecosystems easily.

Why would I take anything away beyond the specific scope of the vulnerability to supply chain issues that NPM had? Cargo offers a variety of tools for auditing and managing dependencies that specifically mitigate supply chain issues. If your only suggestion is to not use dependencies at all, that's an extreme opinion.

Related:We pwned X, Vercel, Cursor, and Discord through a supply-chain attackhttps://news.ycombinator.com/item?id=46317098

This is part of what's broken. If your users aren't examining your code, then they're vulnerable to supply-chain attacks from it.

Plug: I've been building tooling to easily audit third-party open-source dependencies for supply chain attacks. Packj [1] analyzes Python/NPM/Rubygems packages for several risky code and attributes such as Network/File permissions, expired email domains, etc. Auditing hundreds of direct/transitive dependencies manually is impractical, but Packj can quickly point out if a package accesses sensitive files (e.g., SSH keys), spawns shell, exfiltrates data, is abandoned, lack

Mostly to avoid a situation like this https://www.bleepingcomputer.com/news/security/researcher-ha...(This week's hack using npm, gems etc to trick non-java build tools to not use internal repos but the hacker's compromised packages instead)