jonchurch

jonchurch

@jonchurch.com

maintaining express, lodash / ex-msft

126 followers150 following204 posts

jonchurch reposted

npm
@npmjs.com

npm Granular Access Tokens that bypass 2FA can no longer manage your account, org, or packages—those actions now require an interactive 2FA challenge, closing a major credential-based attack surface. github.blog/changelog/20...

github.blogRestricting npm bypass-2FA granular access tokens - GitHub Changelognpm granular access tokens (GATs) configured to bypass 2FA can no longer perform sensitive account, org, and package management actions. These now require an interactive 2FA challenge, closing one of…
jonchurch
@jonchurch.com

The saddest part about the npm worms for me is watching an opt in security feature be used as the delivery vector to the registry.

jonchurch
@jonchurch.com

Btw, you can give gh cli a readonly token instead of the normal gh auth method which will have write. Drastically reduces blast radius if you are concerned about your gh cli token being stolen (which you should be) gh auth login —with-token hit enter Then paste the token, it will persist for you

jonchurch
@jonchurch.com

Does anyone have a link to an in depth write up of the tanstack attack, the CI compromise bit? I ask bc I am doing my own analysis and the official post mortem doesnt seem to get all the details right. That or I am misunderstanding something, so want to see if a real expert has written this up

View full thread
jonchurch
@jonchurch.com

Adnan himself also correctly called out the specific CI step which executed the malicious payload within the release job, the post step of the checkout job That is the detail which was not explicitly called out in the post mortem and sent me searching for it myself x.com/adnanthekhan...

x.comAdnan Khan on X: "This attack leveraged GitHub Actions Cache Poisoning. Payload deployed here: https://t.co/TawmjgwdBB It looks like it detonated here: https://t.co/Cfeoa4aSgo" / XThis attack leveraged GitHub Actions Cache Poisoning. Payload deployed here: https://t.co/TawmjgwdBB It looks like it detonated here: https://t.co/Cfeoa4aSgo
jonchurch
@jonchurch.com

Those logs will eventually age out, so here is a screenshot. Attackers overwrote the CJS index.js file with an ESM trojaned version, hence the node warning here. Normally Cacheract eats the log output (post checkout logs are a lot more noisey than this)

jonchurch
@jonchurch.com

In summary, what I learned is that the poisoned cache caused trojan versions of the checkout and cache GH actions to be restored over the their true versions within the release job. This is known as Cacheract, the vuln discovered by @adnanthekhan.bsky.social github.com/AdnaneKhan/C...

github.comGitHub - AdnaneKhan/Cacheract: GitHub Actions Cache Native Malware - for Educational and Research Purposes only.GitHub Actions Cache Native Malware - for Educational and Research Purposes only. - AdnaneKhan/Cacheract
jonchurch@jonchurch.com

Does anyone have a link to an in depth write up of the tanstack attack, the CI compromise bit? I ask bc I am doing my own analysis and the official post mortem doesnt seem to get all the details right. That or I am misunderstanding something, so want to see if a real expert has written this up

jonchurch
@jonchurch.com

Does anyone have a link to an in depth write up of the tanstack attack, the CI compromise bit? I ask bc I am doing my own analysis and the official post mortem doesnt seem to get all the details right. That or I am misunderstanding something, so want to see if a real expert has written this up

View full thread
jonchurch
@jonchurch.com

The specific mechanism of compromise, of what the poisoned cache actually did and what files were poisoned, was overwriting actions/checkout and actions/cache files in the runner fs once the cache was restored Thats the attacker controlled code that executed within the release job

jonchurch
@jonchurch.com

That is a core function of Cacheract, the class of attack discovered by @adnanthekhan.bsky.social The post mortem credits his work, but did not spell out the technical details of the CI compromise or name Cacheract, and the missing detail sent me down a rabbit hole github.com/AdnaneKhan/C...

github.comGitHub - AdnaneKhan/Cacheract: GitHub Actions Cache Native Malware - for Educational and Research Purposes only.GitHub Actions Cache Native Malware - for Educational and Research Purposes only. - AdnaneKhan/Cacheract
jonchurch
@jonchurch.com

Does anyone have a link to an in depth write up of the tanstack attack, the CI compromise bit? I ask bc I am doing my own analysis and the official post mortem doesnt seem to get all the details right. That or I am misunderstanding something, so want to see if a real expert has written this up

jonchurch
@jonchurch.com

fwiw I did bottom out on this The post mortem is correct, but under specified the details of compromise in CI for what I wanted to know Ive since pieced it together from the malicious fork commit, and it was Cacheract. This is not new information

jonchurch
@jonchurch.com

19 years, I cant imagine doing any job for 19 years. Apparently they only film 4 days a week (with 2 eps filmed on thursday) but that still sounds grueling

jonchurch
@jonchurch.com

There is no Trusted Publishing setup which prevents a compromised repo admin's github PAT from triggering an npm publish, right? I've spent months trying to find something, but deploy envs w/ required reviews, workflow guards, branch protections, signed tags. All of it can be overwritten w/o 2fa

jonchurch
@jonchurch.com

I am still hopeful I am wrong! But I think it's a "fox in the hen house" situation, and gating TP inside github cannot guard against admins getting their github cli token slurped up.

jonchurch reposted

James Snell
@jasnell.me

Replying to @jasnell.me

So... we've decided to change things up. NodeConf EU 2026 will be hosted in Bologna, Italy this year. The dates are set for September 29th and 30th, 2026.

jonchurch
@jonchurch.com

Theres been an npmx bug that’s bothered me for a few weeks now. User profiles are showing almost random packages. Its a subset of your packages, first I thought it was dropping anything in an npm org dug a little and it was worse. It shows packages _where the gh user is the same as the npm user_

jonchurch
@jonchurch.com

The issue is here if you are curious. I have a PR up to fix it, algolia folks took a change upstream which made this much nicer to fix ❤️ github.com/npmx-dev/npm...

github.com`~user` profile pages show packages by repo owner, not npm maintainer · Issue #2504 · npmx-dev/npmx.devThe Problem When I visit a user profile I expect to see a list of the packages that npm user is a maintainer of. However, when using the (default) Algolia search provider the profile page lists any...
jonchurch
@jonchurch.com

jokes on them, ignoring my inbox has long been part of my security posture

Socket@socket.dev

🚨 New Investigation: Attackers are hunting the maintainers behind Lodash, Fastify, buffer, Pino, mocha, Express, and #Nodejs core, because compromising one of them means write access to packages downloaded billions of times a week. socket.dev/blog/attacke...

socket.devAttackers Are Hunting High-Impact Node.js Maintainers in a C...Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
jonchurch
@jonchurch.com

We released a lodash patch today, everything went well so havent really thought about it since. A non event. Released a minor yesterday, and it broke stuff and immediately heard about it. Couldnt stop thinking about it until we fixed it EoD today 🫠

jonchurch
@jonchurch.com

we all know npm stats are a blunt metric, and a rising tide of JS continuing to eat the world lifts all boats but got damn 👏 does anyone have stats about how npm downloads in general grow YoY?

jonchurch
@jonchurch.com

It's not just lodash, to be clear, it seems like a lot of packages are having a pretty sharp increase this week calling out lodash bc of the big number milestone

View full thread
jonchurch
@jonchurch.com

Im asking for a goodwill credit 🤞as I just didnt realize running my simple focused query less than 10 times could spend that But ultimately there’s no good way to do this research today that Im aware of

jonchurch
@jonchurch.com

I got most of what I wanted for a specific package, but npm registry data access just doesnt exist anymore and has been lacking for a long time. This bigquery dataset is still the best way I know to do this, and it still doesnt give me everything I need.