npm v12 Shuts Down a Popular Malware Trick — But the Threat Isn’t Going Away

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

For years, one of the easiest ways to sneak malware onto a developer’s machine has been to hide in plain sight. Install a package from npm, and any lifecycle script bundled with it runs automatically — no review, no approval, no second look. Attackers have known this for a long time, and they’ve used it well. A poisoned package with a malicious “postinstall” script doesn’t require a developer to do anything other than run npm install. npm v12 changes that. Lifecycle scripts no longer execute automatically during installation. Developers now have to approve them first. It’s a meaningful shift, and one that security teams have wanted for a while. But according to a new analysis from Checkmarx, closing this door doesn’t close the case. It may just move attackers toward a different target: runtime. “It’s a bit like locking a door in a glass house: robbers will just start breaking windows,” said Darren Meyer, security research advocate at Checkmarx. “Malware authors often use lifecycle scripts because they’re nearly guaranteed to execute. Infecting the modules in a way that works at runtime requires a little more effort. But with npm’s changes now ‘locking the door,’ the authors will almost certainly find the additional effort worth it.” That’s the core tension behind npm v12’s new protection. It raises the cost of the easiest attack path, and that’s genuinely useful — attacker cost is one of the few levers defenders actually control. But it doesn’t remove the incentive to compromise packages in the first place. It just pushes attackers to hide malicious behavior inside code …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://devops.com/npm-v12-shuts-down-a-popular-malware-trick-but-the-threat-isnt-going-away/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.