{"id":5026,"date":"2018-12-10T20:50:04","date_gmt":"2018-12-10T19:50:04","guid":{"rendered":"https:\/\/monodes.com\/predaelli\/?p=5026"},"modified":"2018-12-10T14:53:01","modified_gmt":"2018-12-10T13:53:01","slug":"exploiting-developer-infrastructure-is-ridiculously-easy","status":"publish","type":"post","link":"https:\/\/monodes.com\/predaelli\/2018\/12\/10\/exploiting-developer-infrastructure-is-ridiculously-easy\/","title":{"rendered":"Exploiting Developer Infrastructure Is Ridiculously Easy"},"content":{"rendered":"
\n

\"\"\/<\/a>The open-source ecosystem is broken<\/h1>\n<\/blockquote>\n

Source: Exploiting Developer Infrastructure Is Ridiculously Easy<\/a><\/em><\/p>\n

That’s why Debian has its own repositories.<\/p>\n

<\/p>\n

\n

Exploiting Developer Infrastructure Is Ridiculously Easy<\/h1>\n

The open-source ecosystem is broken<\/p>\n

\n
\n
\"Go<\/a><\/div>\n
\n
\n
\n
Jarrod Overson<\/a><\/p>\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
<\/div>\n
\n

Photo: Charles Deluvio<\/a>\/Unsplash<\/a><\/p>\n<\/div>\n<\/div>\n<\/section>\n

\n
\n
\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
<\/div>\n
<\/div>\n
\n
\n
\n
<\/div>\n
\n

In<\/span> late October, an issue was opened on an extremely popular node.js tool, nodemon, describing a deprecation warning<\/a> that was being logged to the console.<\/p>\n

Warnings like these aren\u2019t uncommon. This one seemed harmless. It wasn\u2019t even related to the nodemon project, but rather to one of its dependencies. This easily could have gone completely ignored because, in many cases, warnings like these often resolve themselves.<\/p>\n

About three weeks after the initial report, Ayrton Sparling<\/a> experienced the log output himself and found that a new dependency<\/a> several layers deep was the cause of the warning. The output was coming from a strange bit of code at the end of a minified JavaScript file that did not exist in an earlier version and had been removed in a later version (compare flatmap-stream@0.1.0<\/a>, flatmap-stream@0.1.1<\/a>, and flatmap-stream@0.1.2<\/a>). Ayrton\u2019s research led him to a popular npm library, event-stream<\/a>, which is downloaded nearly two million times a week and, up until recently, was maintained by a reputable open-source developer.<\/p>\n

Several months ago, control of event-stream changed hands, legitimately, to a relatively unknown user who asked for publishing rights over email<\/a>. This user then updated event-stream to include the exploited flatmap-stream dependency in a patch version and then bumped the major version of event-stream without the dependency to limit the visibility of the change. New users who, presumably, are a little more inclined to question dependencies would get the latest version (4.x as of this writing) and users who depend on the previous version would automatically update to the infected patch release whenever npm install runs again (with many common configurations).<\/p>\n

Details of the Exploit<\/h3>\n

The payload on flatmap-stream was set up to ingest a data file<\/a> that had, among some trivially obfuscated strings, two encrypted payloads that could only be decrypted with a known password.<\/p>\n

\n
\n
<\/div>\n
<\/div>\n<\/div>\n<\/figure>\n<\/div>\n<\/div>\n<\/section>\n<\/div>\n
\n
\n
\n