Abuse of package managers
2021-02-11 16:01:08.352184+00 by
Dan Lyke
1 comments
Researcher hacks over 35 tech firms in novel supply chain attack
Birsan soon realized, should a dependency package used by an application exist in both a public open-source repository and your private build, the public package would get priority and be pulled instead -- without needing any action from the developer.
In some cases, as with PyPI packages, the researcher noticed that the package with the higher version would be prioritized regardless of wherever it was located.
Via https://mobile.twitter.com/hmemcpy/status/1359478493386592267
[ related topics:
Current Events
]
comments in ascending chronological order (reverse):
#Comment Re: Abuse of package managers made: 2021-02-12 12:45:53.512528+00 by:
DaveP
Somewhat similarly, I spent weeks chasing down a weird problem in ${PRODUCT} which turned out
to be caused by one of our copies of node.js allocating an object, which then got freed by a different
copy of node.js which was using a different allocator because reasons. That was about 2016 or
2017... One of the things I noticed along the way was that pieces-parts were being pulled from all
over the internet, and if I firewalled off some less reputable sites, the build packaging would fail
because one of the repositories couldn’t be reached. Mentioned it to the bosses, but never chased
that observation down to “hey, we could pull the worng framework down.”
Oh well. Not the only problem I retired without solving...