Scribd Logo
Upload

Welcome to Scribd!

  • 11K views

    NPM Hydra Worm

    Uploaded by

    Softpedia
    This document summarizes a potential exploit in the npm package manager that could allow a malicious package to spread rapidly across the npm ecosystem. It describes how a package could execute arbitrary code during installation due to lifecycle scripts running as the current user. Combined with the ability to change dependencies through semver and publish new versions using persistent authentication, a worm could propagate by adding itself as a dependency to popular packages and republishing. This poses a risk as most users install transitive dependencies without review. Suggested mitigations include expiring login tokens, two-factor authentication for publishing, and using a local registry mirror.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    NPM Hydra Worm

    Uploaded by

    Softpedia
    11K views4 pages
    This document summarizes a potential exploit in the npm package manager that could allow a malicious package to spread rapidly across the npm ecosystem. It describes how a package could execute arbitrary code during installation due to lifecycle scripts running as the current user. Combined with the ability to change dependencies through semver and publish new versions using persistent authentication, a worm could propagate by adding itself as a dependency to popular packages and republishing. This poses a risk as most users install transitive dependencies without review. Suggested mitigations include expiring login tokens, two-factor authentication for publishing, and using a local registry mirror.

    Original Description:

    npm hydra worm

    Original Title

    npm hydra worm

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document summarizes a potential exploit in the npm package manager that could allow a malicious package to spread rapidly across the npm ecosystem. It describes how a package could execute arbitrary code during installation due to lifecycle scripts running as the current user. Combined with the ability to change dependencies through semver and publish new versions using persistent authentication, a worm could propagate by adding itself as a dependency to popular packages and republishing. This poses a risk as most users install transitive dependencies without review. Suggested mitigations include expiring login tokens, two-factor authentication for publishing, and using a local registry mirror.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    11K views4 pages

    NPM Hydra Worm

    Uploaded by

    Softpedia
    This document summarizes a potential exploit in the npm package manager that could allow a malicious package to spread rapidly across the npm ecosystem. It describes how a package could execute arbitrary code during installation due to lifecycle scripts running as the current user. Combined with the ability to change dependencies through semver and publish new versions using persistent authentication, a worm could propagate by adding itself as a dependency to popular packages and republishing. This poses a risk as most users install transitive dependencies without review. Suggested mitigations include expiring login tokens, two-factor authentication for publishing, and using a local registry mirror.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 4

    npmhydrawormdisclosure

    Author:SamSaccone

    tl;dr
    Itispossibleforasinglemaliciousnpmpackagetospreaditselfacrossmostofthenpm
    ecosystemveryquickly.Thispackagecouldenabledeliveryofapotentiallytargeted,malicious
    payloadtocorporateentities.

    Installingcodefromapackagemanagerhasthesamelevelofsecurityas
    curlsite.com|
    bash
    ,
    howeverthemajorityofdevelopersperceivegeminstalloraptgetinstallornpminstallto
    belessrisky.

    Thenpmpackagemanager,likemostotherpackagemanagershasaconceptof
    lifecycle
    scripts
    .Thesescriptscanexecutearbitrarycommandsonyoursystem(ideallydoingoperations
    likecompilingcode).Innpm,theselifecyclehooksrunasthecurrentuser(ifrunwithsudothe
    commandrunsas
    nobody
    ),withthecurrentpermissionsinanonsandboxedenvironment.
    Simplyput,anythingthatyoucando,thescriptscando.
    However,thenpmclientandregistryareexploitableduetoacombinationofthefollowing
    factors.

    Factor 1: semver allows for changing dependencies


    Thefirstpart
    oftheexploitbeginswiththesimplefactthatnpmencouragesusersto
    usesemver.Installeddependenciesarenotlockedtoaspecificversionbydefaultandusers
    mustmanuallylocktheirprojectsvia
    npmshrinkwrap
    .Itisimportanttokeepinmindthat
    packageshavesubdependenciesthatalsomayhavesemverrangesfortheirdependencies,
    andsoonandsoon.

    Let'stake
    PhoneGap
    forexample.Currentlyithas463transitivedependencies,andofthose
    dependencies,276individualnpmaccountscanpushnewversionsofthesepackages.This
    meansthatwhensomeonedoesnpminstallinsideoftheproject463unknownandunlocked
    dependenciesareinstalled,eachwiththeabilitytoexecutearbitrarycodeatinstalltime.

    Factor 2: Persistent auth allows any script to publish with user credentials
    Thesecondpart
    oftheexploitdependsonthefactthatonceauserisloggedintonpmontheir
    systemtheyareneverloggedoutuntiltheymanuallydoso.Sincenpmcanrunarbitraryscripts
    oninstallthatmeansthatanyuserwhoiscurrentlyloggedinandtypesnpminstallisallowing
    anymoduletoexecutearbitrarypublishcommands.

    Factor 3: Centralized registry serves huge userbase daily


    Thethirdpart
    oftheexploitisdependentonthatfactthatasingularnpmregistryisusedbythe
    thelargemajorityofthenode.jsecosystemonadailybasis,andtyping
    npmpublish
    ships
    yourcodetosaidregistryserver,tobeinstalledbyanyone.

    Exploit Steps
    Giventheabovecombinationoffactors,itisatrivialexercisetoauthortheselfreplicating
    exploit.Forexample:

    1. Sociallyengineeranpmmoduleownertonpminstallaninfectedmoduleontheir
    system.
    2. Wormcreatesanewnpmmodule
    3. Wormsetsalifecyclehookonthenewnpmmoduletoexecutethewormonanyinstall
    4. Wormpublishesthenewmoduletotheuser'snpmaccount
    5. Wormwalksalloftheusersownednpmmodules(withpublishpermissions)andadds
    thenewmoduleasadependencyineach's
    package.json
    .
    6. Wormpublishesnewversionstoeachoftheownedmoduleswitha
    bugfixlevelsemver
    bump.Thisensuresthemajorityofdependentmodulesusingthe
    ^
    or
    ~
    signifierwill
    includetheselfreplicatingmoduleduringthenextinstall.

    Exploit Impact
    Withthesesteps,thewormwouldbeabletoquicklyspreadacrosstheecosystemasusers
    installedpackages,asmostnpmusersdowithoutthinking.Using
    PhoneGap
    asatestbed,it
    wouldonlytake1personoutofthe276toinstallapackagethatcontainedthewormtoinfect
    the
    PhoneGap
    project.

    Mitigation strategies:
    User mitigation:

    Asauserwhoownsmodulesyoushouldnotstayloggedintonpm.(Easilyenough,
    npm
    logout
    and
    npmlogin
    )
    Use
    npm
    shrinkwrap
    tolockdownyourdependencies
    Use
    npminstall
    someModule
    ignorescripts

    npm mitigation:

    Automaticallyexpirelogintokens
    Requiresomeformoftwofactorauthforpublishoperations
    Tellusersthattheyshouldlogout

    Corporate mitigation:

    Runalocalmirrorofthenpmregistry
    Preventinstallingfromthemainregistry,andinsteaduseatrustedauditedregistry.

    Timeline of disclosures:

    Jan12016
    Initialdiscoveryofexploit
    Jan42016
    Initialdisclosure+proofofconcepttonpm
    Jan52016
    PrivatedisclosuretoFacebook
    Jan72016
    Responsefromnpm
    Jan82016
    Confirmationofworksasintendednointentiontofixatthemomentfrom
    npm.
    Feb52016
    Sharedthedisclosuredoc

    Jan262015
    "forced"reminderof"scriptrunsasuser"badnessdemonstration?
    https://github.com/joaojeronimo/rimrafall
    Jan272015
    AdamBaldwin(nodesecurityexpert)followup
    https://blog.liftsecurity.io/2015/01/27/amaliciousmoduleonnpm

    You might also like