Securing NPM Packages

  • Importance of scrutinizing NPM packages for potential security risks.
  • Exploration of how malware can be run and analyzed safely.
  • Introduction to tools like LavaLab and Hardin JavaScript for securing applications.
  • Understanding the compartmentalization approach to isolate malicious code.
  • Practical steps to utilize Lafamote for enhancing supply chain security.

In the world of software development, using third-party libraries is a common practice that accelerates the development process. However, this convenience comes with its own set of risks, particularly when it concerns security vulnerabilities. NPM packages, while incredibly useful, can sometimes harbor malicious code that developers might unknowingly introduce into their applications. Understanding these risks and implementing effective defense strategies is crucial for maintaining the integrity of software systems.

Imagine receiving a string of code from an unknown source and incorporating it directly into your production environment without any inspection. This scenario parallels how many developers use NPM packages. These packages, essentially tar.gz files, are often unsanitized inputs from anonymous sources on the internet. While most packages are benign, some may contain malicious code designed to exploit vulnerabilities in your application.

My journey into the realm of supply chain security began with identifying vulnerable dependencies and realizing the need for a structured response. This led to the creation of tools like NPM Audit Resolver and further exploration into malicious install scripts. The focus shifted towards defending against malicious packages that infiltrate applications despite existing defenses. This endeavor is crucial, as relying solely on preemptive measures may not be sufficient.

The process of exploring malicious packages often involves tools like Socket Dev, where one can examine package contents without the risk of immediate removal by NPM. This exploration revealed that some packages are heavily obfuscated, requiring layers of deobfuscation to understand their functionality. However, instead of relying solely on manual deobfuscation, utilizing runtime protection tools can offer a more efficient solution.

One such tool is LavaLab, which allows for the safe execution and analysis of malware in a controlled environment. By simulating the runtime behavior of malicious code, it's possible to understand its operations without directly deobfuscating it. This method involves intercepting and controlling various function calls, ensuring that the malware cannot access or manipulate critical system resources.

Running malware safely requires meticulous attention to the code's behavior, such as its attempts to require certain modules or access environment variables. By denying these requests and providing fake responses, it's possible to observe the malware's intent without allowing it to execute harmful actions. This approach highlights the importance of understanding the malware's requirements and controlling its execution flow.

Beyond traditional obfuscation, some malware can be delivered as pre-compiled bytecode, which poses additional challenges. This technique exploits the fact that certain execution environments, like Node.js, do not thoroughly verify the consistency between source code and bytecode. As a result, malicious bytecode can be executed without disclosing the readable source code.

Addressing these threats requires a robust defense strategy that extends beyond initial code audits. Tools like Hardin JavaScript provide mechanisms to manage scope and import controls, effectively isolating malicious code during execution. This approach leverages the compartmentalization of JavaScript, allowing developers to restrict access to sensitive APIs and resources.

Hardin JavaScript introduces two key concepts: compartments and lockdowns. Compartments enable scope isolation, ensuring that each piece of code operates within its own environment. Lockdowns prevent prototype pollution, safeguarding the integrity of JavaScript's intrinsic objects. These measures collectively enhance the security of applications by mitigating the impact of potentially malicious code.

Lavamote, a tool built on the principles of Hardin JavaScript, offers a practical solution for developers concerned about supply chain security. By compartmentalizing each package, Lavamote ensures that code execution is isolated and controlled. This isolation prevents malicious packages from accessing global resources or interfering with other dependencies.

Implementing Lavamote involves configuring policies that dictate which packages have access to specific resources. This process includes reviewing generated policy files and making informed decisions about the permissions granted to each package. With Lavamote, developers can effectively mitigate the risks associated with using third-party libraries, transforming their runtime environment into a secure fortress against malicious code.

In a demonstration of Lavamote's capabilities, a simple web application with a potentially malicious dependency was examined. By using Lavamote, the application's execution was monitored, and unauthorized access attempts were intercepted. This exercise underscored the tool's effectiveness in safeguarding sensitive data and maintaining the application's security posture.

For developers seeking to enhance their application's security, starting with tools like allowscripts can be an efficient first step. This tool, part of the Lavamote suite, provides a straightforward way to prevent known attacks from malicious packages. As developers explore the full range of Lavamote's features, they can customize security policies to suit their specific needs, ensuring a robust defense against evolving threats.

By embracing these advanced security practices, developers can confidently navigate the complexities of modern software development. Understanding the risks posed by NPM packages and employing tools like LavaLab, Hardin JavaScript, and Lavamote empowers developers to build secure, resilient applications that stand firm against malicious attacks. As the landscape of software security continues to evolve, staying informed and proactive is the key to safeguarding the integrity of our digital world.

Watch full talk with demos and examples:

Watch video on a separate page
Rate this content
Bookmark

This talk has been presented at JSNation US 2024, check out the latest edition of this JavaScript Conference.

FAQ

The presentation focuses on security concerns related to running malware directly from NPM, exploring malicious packages, and defending applications against them.

NPM packages are compared to unsanitized input from random people online, which are consumed and run in production without reading.

The main concern is the potential for malicious packages to be included in applications, leading to security vulnerabilities.

Malicious NPM packages can be explored on Socket Dev, where old versions are not removed, allowing users to view and download package contents.

Hardin JavaScript is a security tool that controls the scope and import mechanisms in JavaScript, providing scope isolation and preventing prototype pollution.

Using security tools like Lafamote is important to protect applications from malicious packages that could compromise security if they run in production.

LavaLab is used to run and evaluate malware samples in a controlled environment, allowing the speaker to demonstrate how malware operates.

The speaker is Zebe, a JavaScript and Node enthusiast with a focus on security, working on Labemote and running a Meetup and conference group called MeetJS.

Lafamote improves security by placing each package in its own compartment, controlling dependency structure, and allowing selective access to globals and imports.

The speaker created NPM Audit Resolver to address vulnerable dependencies by providing a structured way to manage them.

Zbyszek Tenerowicz
Zbyszek Tenerowicz
21 min
21 Nov, 2024

Comments

Sign in or register to post your comment.

Check out more articles and videos

We constantly think of articles and videos that might spark Git people interest / skill us up or help building a stellar career

Levelling up Monorepos with npm Workspaces
DevOps.js Conf 2022DevOps.js Conf 2022
33 min
Levelling up Monorepos with npm Workspaces
Top Content
NPM workspaces help manage multiple nested packages within a single top-level package, improving since the release of NPM CLI 7.0. You can easily add dependencies to workspaces and handle duplications. Running scripts and orchestration in a monorepo is made easier with NPM workspaces. The npm pkg command is useful for setting and retrieving keys and values from package.json files. NPM workspaces offer benefits compared to Lerna and future plans include better workspace linking and adding missing features.
It's a Jungle Out There: What's Really Going on Inside Your Node_Modules Folder
Node Congress 2022Node Congress 2022
26 min
It's a Jungle Out There: What's Really Going on Inside Your Node_Modules Folder
Top Content
The talk discusses the importance of supply chain security in the open source ecosystem, highlighting the risks of relying on open source code without proper code review. It explores the trend of supply chain attacks and the need for a new approach to detect and block malicious dependencies. The talk also introduces Socket, a tool that assesses the security of packages and provides automation and analysis to protect against malware and supply chain attacks. It emphasizes the need to prioritize security in software development and offers insights into potential solutions such as realms and Deno's command line flags.
The State of Passwordless Auth on the Web
JSNation 2023JSNation 2023
30 min
The State of Passwordless Auth on the Web
Passwords are terrible and easily hacked, with most people not using password managers. The credential management API and autocomplete attribute can improve user experience and security. Two-factor authentication enhances security but regresses user experience. Passkeys offer a seamless and secure login experience, but browser support may be limited. Recommendations include detecting Passkey support and offering fallbacks to passwords and two-factor authentication.
5 Ways You Could Have Hacked Node.js
JSNation 2023JSNation 2023
22 min
5 Ways You Could Have Hacked Node.js
Top Content
The Node.js security team is responsible for addressing vulnerabilities and receives reports through HackerOne. The Talk discusses various hacking techniques, including DLL injections and DNS rebinding attacks. It also highlights Node.js security vulnerabilities such as HTTP request smuggling and certification validation. The importance of using HTTP proxy tunneling and the experimental permission model in Node.js 20 is emphasized. NearForm, a company specializing in Node.js, offers services for scaling and improving security.
Content Security Policy with Next.js: Leveling Up your Website's Security
React Summit US 2023React Summit US 2023
9 min
Content Security Policy with Next.js: Leveling Up your Website's Security
Top Content
Watch video: Content Security Policy with Next.js: Leveling Up your Website's Security
Lucas Estevão, a Principal UI Engineer and Technical Manager at Avenue Code, discusses how to implement Content Security Policy (CSP) with Next.js to enhance website security. He explains that CSP is a security layer that protects against cross-site scripting and data injection attacks by restricting browser functionality. The talk covers adding CSP to an XJS application using meta tags or headers, and demonstrates the use of the 'nonce' attribute for allowing inline scripts securely. Estevão also highlights the importance of using content security reports to identify and improve application security.
Let Me Show You How React Applications Get Hacked in the Real-World
React Advanced 2021React Advanced 2021
22 min
Let Me Show You How React Applications Get Hacked in the Real-World
Top Content
React's default security against XSS vulnerabilities, exploring and fixing XSS vulnerabilities in React, exploring control characters and security issues, exploring an alternative solution for JSON parsing, and exploring JSON input and third-party dependencies.

Workshops on related topic

Hands-On Workshop: Introduction to Pentesting for Web Apps / Web APIs
JSNation US 2024JSNation US 2024
148 min
Hands-On Workshop: Introduction to Pentesting for Web Apps / Web APIs
Featured Workshop
Gregor Biswanger
Gregor Biswanger
In this hands-on workshop, you will be equipped with the tools to effectively test the security of web applications. This course is designed for beginners as well as those already familiar with web application security testing who wish to expand their knowledge. In a world where websites play an increasingly central role, ensuring the security of these technologies is crucial. Understanding the attacker's perspective and knowing the appropriate defense mechanisms have become essential skills for IT professionals.This workshop, led by the renowned trainer Gregor Biswanger, will guide you through the use of industry-standard pentesting tools such as Burp Suite, OWASP ZAP, and the professional pentesting framework Metasploit. You will learn how to identify and exploit common vulnerabilities in web applications. Through practical exercises and challenges, you will be able to put your theoretical knowledge into practice and expand it. In this course, you will acquire the fundamental skills necessary to protect your websites from attacks and enhance the security of your systems.
0 to Auth in an hour with ReactJS
React Summit 2023React Summit 2023
56 min
0 to Auth in an hour with ReactJS
WorkshopFree
Kevin Gao
Kevin Gao
Passwordless authentication may seem complex, but it is simple to add it to any app using the right tool. There are multiple alternatives that are much better than passwords to identify and authenticate your users - including SSO, SAML, OAuth, Magic Links, One-Time Passwords, and Authenticator Apps.
While addressing security aspects and avoiding common pitfalls, we will enhance a full-stack JS application (Node.js backend + React frontend) to authenticate users with OAuth (social login) and One Time Passwords (email), including:- User authentication - Managing user interactions, returning session / refresh JWTs- Session management and validation - Storing the session securely for subsequent client requests, validating / refreshing sessions- Basic Authorization - extracting and validating claims from the session token JWT and handling authorization in backend flows
At the end of the workshop, we will also touch other approaches of authentication implementation with Descope - using frontend or backend SDKs.
OWASP Top Ten Security Vulnerabilities in Node.js
JSNation 2024JSNation 2024
97 min
OWASP Top Ten Security Vulnerabilities in Node.js
Workshop
Marco Ippolito
Marco Ippolito
In this workshop, we'll cover the top 10 most common vulnerabilities and critical security risks identified by OWASP, which is a trusted authority in Web Application Security.During the workshop, you will learn how to prevent these vulnerabilities and develop the ability to recognize them in web applications.The workshop includes 10 code challenges that represent each of the OWASP's most common vulnerabilities. There will be given hints to help solve the vulnerabilities and pass the tests.The trainer will also provide detailed explanations, slides, and real-life examples in Node.js to help understand the problems better. Additionally, you'll gain insights from a Node.js Maintainer who will share how they manage security within a large project.It's suitable for Node.js Developers of all skill levels, from beginners to experts, it requires a general knowledge of web application and JavaScript.
Table of contents:- Broken Access Control- Cryptographic Failures- Injection- Insecure Design- Security Misconfiguration- Vulnerable and Outdated Components- Identification and Authentication Failures- Software and Data Integrity Failures- Security Logging and Monitoring Failures- Server-Side Request Forgery
How to Build Front-End Access Control with NFTs
JSNation 2024JSNation 2024
88 min
How to Build Front-End Access Control with NFTs
WorkshopFree
Solange Gueiros
Solange Gueiros
Understand the fundamentals of NFT technology and its application in bolstering web security. Through practical demonstrations and hands-on exercises, attendees will learn how to seamlessly integrate NFT-based access control mechanisms into their front-end development projects.
Finding, Hacking and fixing your NodeJS Vulnerabilities with Snyk
JSNation 2022JSNation 2022
99 min
Finding, Hacking and fixing your NodeJS Vulnerabilities with Snyk
WorkshopFree
Matthew Salmon
Matthew Salmon
npm and security, how much do you know about your dependencies?Hack-along, live hacking of a vulnerable Node app https://github.com/snyk-labs/nodejs-goof, Vulnerabilities from both Open source and written code. Encouraged to download the application and hack along with us.Fixing the issues and an introduction to Snyk with a demo.Open questions.
Bring Code Quality and Security to your CI/CD pipeline
DevOps.js Conf 2022DevOps.js Conf 2022
76 min
Bring Code Quality and Security to your CI/CD pipeline
WorkshopFree
Elena Vilchik
Elena Vilchik
In this workshop we will go through all the aspects and stages when integrating your project into Code Quality and Security Ecosystem. We will take a simple web-application as a starting point and create a CI pipeline triggering code quality monitoring for it. We will do a full development cycle starting from coding in the IDE and opening a Pull Request and I will show you how you can control the quality at those stages. At the end of the workshop you will be ready to enable such integration for your own projects.