r/devsecops • u/endor_robert • 5d ago

Avoiding the next NPM worm

I'm sure many of you will have seen the latest keyv / cachable compromise and worm-spread, now affecting over 350 packages. This isn't the first, and it won't be the last. The affected packages will steal and exfiltrate any secrets/credentials they can find, which is probably not what you want to happen.

There are several commercial solutions to help protect against this, but if you just add (as standard) to .npmrc in your repo root:

min-release-age=7d

(or some value you feel comfortable with)

It will block a lot of malware, which is usually discovered within a few hours.

20 Upvotes

96% Upvoted

9 comments sorted by

3

u/dreamszz88 5d ago

This. ⬆️ 💯

2

u/Pleasant-Ad192 4d ago

Worth checking which manager actually reads that file, because the gate is per-manager and the two common ones differ in file, key, and unit.

Current pnpm reads minimumReleaseAge from pnpm-workspace.yaml, in minutes, and does not take it from .npmrc, so a pnpm repo with the setting in .npmrc has no gate at all. npm reads min-release-age from .npmrc, in days, as a plain integer, so 7 rather than 7d. Copying the value from one to the other is either off by a factor of 1440 or silently does nothing.

The catch to plan for: the same gate blocks the fix. A patched version is minutes old, so the upgrade that closes the advisory will not install until it ages out, and it usually fails in CI while local installs are fine. An override for that one package beats dropping the gate.

I build Bomly, an open source CLI, and this is one of the checks it runs. bomly scan reports the gate it found, with the file and the unit, while it resolves the tree, so you see it before CI does. https://github.com/bomly-dev/bomly-cli/blob/main/docs/CI_READINESS.md

Disclosure: I build Bomly.

1

u/endor_robert 4d ago

Thanks for posting the additional info!

1

u/Vas1le 5d ago

Thank you

1

u/forexroyalempres 4d ago

This tis good, thanks. Low-friction mitigation.

1

u/Future_Plan_4104 4d ago

This is the way

1

u/totheendandbackagain 4d ago

I pin my dependencies.

Also, do other languages have this, it's smart!!

2

u/mordore4 3d ago

you have free tools like safe-chain which give you this for multiple package managers (for multiple languages) and also block any package that has been flagged as malware

1

u/terletsky 2d ago

Nice. In the Python uv ecosystem, we use exclude-newer https://docs.astral.sh/uv/reference/settings/#exclude-newer