The npm registry for the Node.js JavaScript runtime environment is the so-called obvious confusion This attack could allow threat actors to hide malware in project dependencies or execute arbitrary scripts during installation.
“The npm package manifest is published independently of the tarball,” former GitHub and npm engineering manager Darcy Clarke said in a technical article published last week. “The manifest is never fully validated against the tarball contents.”
“The ecosystem widely assumes that manifest and tarball content is consistent,” added Clarke.
The crux of the problem stems from the fact that the manifest and package metadata are separate and not cross-referenced to each other, resulting in unexpected behavior and misuse when there are discrepancies.
As a result, a threat actor could exploit this loophole to publish a module with a manifest file (package.json) containing hidden dependencies, or to run an installation script, thereby breaking the supply chain. It can open avenues for attack and poisoning. developer environment.
Sonatype researcher and journalist Ax Sharma said, “In a development environment that lacks effective DevSecOps workflows and tools, especially the real (vulnerable or malicious) files where the application resides in an open source package. If you blindly trust the application manifest without it, manifest confusion becomes a problem.”
This finding underscores the fact that when downloading packages from open source repositories, we cannot rely solely on the metadata contained in the package manifest file; You should take steps to scan.
Clarke said GitHub has been aware of the issue since at least early November 2022, and the Microsoft subsidiary plans to address the issue internally as of March 2023. However, this issue remains open to this day.
In the absence of an official fix, security researcher Felix Pankratz published a Python script that can be used to test for discrepancies between npm module manifests.
The development was led by developer security firm Snyk, in partnership with Redhunt Labs, to investigate 11,900 repositories in the top 1,000 GitHub organizations for insecure dependencies, finding 1,229,601 vulnerabilities in 15,584 vulnerable dependency files. This was done after discovering a defect.
“Untrusted data deserialization is the most common vulnerability type, with a whopping 130,831 occurrences in Java repositories, or 40% of all vulnerabilities identified,” the study stated. I’m here.
JavaScript-based projects experienced 343,332 cases of prototype pollution, which emerged as a major shortcoming. Denial of service (DoS) flaws contributed most to Python and Ruby projects, with 19,652 and 56,331 respectively.
“Weak dependencies continue to threaten to disrupt the security state of the software supply chain,” said security researchers Umail Neri and Vandana Verma Segar. “As such, developers should take care of the dependencies they use in their projects and keep them up-to-date to keep them patched from known vulnerabilities.”
