'No way to prevent this,' says only package manager where this regularly happens (kevinpatel.xyz)

Article summary

A recent supply chain attack in the npm registry compromised millions of enterprise applications and exposed billions of user records. The attack was met with a sense of inevitability from developers, who believe that such incidents are unavoidable due to the nature of modern web app development. The article highlights the differences in package management and security between the JavaScript ecosystem and other languages like Go and Rust. The npm registry's lack of robust security measures and its reliance on unvetted packages maintained by pseudonymous strangers are seen as contributing factors to the attack.

Main themes

• npm security
• supply chain attacks
• package manager design
• language ecosystem differences
• dependency management
• security guarantees

What commenters say

• The npm package manager's design and lack of security measures make it particularly vulnerable to supply chain attacks.
• Other package managers, such as those used by Go and Rust, have stronger security guarantees that prevent similar attacks.
• The problem is not unique to npm and can affect any package manager that allows dependencies to run arbitrary code.
• The number of dependencies in a project is a major factor in its vulnerability to supply chain attacks, with languages like Rust and JavaScript having more dependencies than others.
• The existence of post-install scripts in npm is a convenient mechanism for malware, but it is not the only possible attack vector.
• Even languages with stronger security guarantees, such as Rust, are not immune to supply chain attacks and can still be vulnerable to malicious dependencies.
• The use of dependencies and modules from untrusted sources is a fundamental risk that applies to all languages and frameworks.
• The difference in attack frequency between npm and other package managers may be due to npm being a more attractive target rather than any inherent security differences.