Not much we didn't know (you're basically SOL since an owner was compromised), however we now have a small peek into the actual meat of the social engineering, which is the only interesting news imho: <a href="https://github.com/axios/axios/issues/10636#issuecomment-4180237789" rel="nofollow">https://github.com/axios/axios/issues/10636#issuecomment-418...</a>
jasonsaayman and voxpelli had useful write ups from the "head on a swivel" perspective of what to watch out for. Jason mentioned "the meeting said something on my system was out of date." they were using Microsoft meeting and that's how they got RCE. Would love more color on that.
An owner being compromised is absolutely survivable on a responsibly run FOSS project with proper commit/review/push signing.<p>This and every other recent supply chain attack was completely preventable.<p>So much so I am very comfortable victim blaming at this point.<p>This is absolutely on the Axios team.<p>Go setup some smartcards for signing git push/commit and publish those keys widely, and mandate signed merge commits so nothing lands on main without two maintainer sigs, and no more single points of failure.
Did you investigate the maintainer compromise and publication path? The malicious version was never committed or pushed via git. The maintainer signs his commits, and v1 releases were using OIDC and provenance attestations. The malicious package versions were published locally using the npm cli after the maintainer's machine was compromised via a RAT; there's no way for package maintainers to disable/forbid local publication on npmjs.<p>It seems the Axios team was largely practicing what you're preaching. To the extent they aren't: it still wouldn't have prevented this compromise.
I can not find a single signed recent commit on the axios repo. It is totally yolo mode. Those "signed by github" signatures are meaningless. I stand by my comment in full.<p>One must sign commits -universally- and -also- sign reviews/merges (multi-party) and then -also- do multi party signing on releases. Doing only one step of basic supply chain security unfortunately buys you about as much defense as locking only a single door.<p>I do however certainly assign significant blame to the NPM team though for repeatedly refusing optional package signing support so packages with signing enabled can be refused at the server and client if unsigned by a quorum of pinned keys, but even aside from that if packages were signed manually then canary tools could have detected this immediately.
It wasn’t done through git. It was a direct npm publish from the compromised machine. If you read further down in the comments (<a href="https://github.com/axios/axios/issues/10636#issuecomment-4181516546" rel="nofollow">https://github.com/axios/axios/issues/10636#issuecomment-418...</a>), it seems difficult to pick the right npm settings to prevent this attack.<p>If I understand it correctly, your suggestions wouldn’t have prevented it, which is evidence that this is not as trivially fixable as you believe it is.
To prevent supply chain attacks you need multi party cryptographic attestation at every layer, which is pretty straight forward, but you are correct, NPM and GitHub controls absolutely will not save you. Microsoft insists their centralized approach can work, but we have plenty of evidence it does not.<p>Operate under the assumption all accounts will be taken over because centralized corporate auth systems are fundamentally vulnerable.<p>This is how you actually fix it:<p>1. Every commit must be signed by a maintainer key listed in the MAINTAINERS file or similar<p>2. Every review/merge must be signed by a -second-
maintainer key<p>3. Every artifact must be build deterministically and be signed by multiple maintainers.<p>4. Have only one online npm publish key maintained in a deterministic and remotely attestable enclave that validates multiple valid maintainer signatures<p>5. Automatically sound the alarm if an NPM release is pushed any other way, and automatically revoke it.
The interesting detail from this thread is that every legitimate v1 release had OIDC provenance attestations and the malicious one didn't, but nobody checks. Even simpler, if you're diffing your lockfile between deploys, a brand new dependency appearing in a patch release is a pretty obvious red flag.
To be honest, I would have assumed the tooling would do attestation verification for me. The diffing the lockfile would be on me though.
npm could solve half of this by letting packages opt into OIDC-only publishing at the registry level. v1 already had provenance attestations but the registry happily accepted the malicious publish without them.
Looks like a very sophisticated operation, and I feel for the maintainer who had his machine compromised.<p>The next incarnation of this, I worry, is that the malware hibernates somehow (e.g., <i>if (Date.now() < 1776188434046) { exit(); }</i>) to maximize the damage.
Incredible uptick in supply chain attacks over the last few weeks.<p>I feel like npm specifically needs to up their game on SA of malicious code embedded in public projects.
That's the reality of modern war. Many countries are likely planting malware on a wide scale. You can't even really prove where an attack originated from, so uninvolved countries would also be smart to take advantage of the current conflict. Like if you primarily wrote German, you would translate your malware to Chinese, Farsi, English, or Hebrew, and take other steps to make it appear to come from one of those warring countries. Any country who was making a long term plan involving malware would likely do it around this time.
NPM is designed to let you run untrusted code on your machine. It will never work. There is no game to step up. It's like asking an ostrich to start flying.
It’s far from a complete solution, but to mitigate this specific avenue of supply chain compromise, couldn’t Github/npm issue single-purpose physical hardware tokens and allow projects (or even mandate, for the most popular ones) maintainers use these hardware tokens as a form of 2FA?
All maintainers need to do is code signing. This is a solved problem but the NPM team has been actively rejecting optional signing support for over a decade now. Even so maintainers could sign their commits anyway, but most are too lazy to spend a few minutes to prevent themselves from being impersonated.
If the solution is 'maintainers just need to do xyz', then it's not a solution, sorry. It's not scalable and which projects become 'successful' and which maintainers accidentally become critical parts of worldwide codebases, is almost pure chance. You will <i>never</i> be able to get all the maintainers you need to 'just' do xyz. Just like you will never be able to get humans to 'just' stop making mistakes. So you had better start looking for a solution that doesn't rely on humans not making mistakes.
Any good payload analysis been published yet? Really curious if this was just a one and done info stealer or if it potentially could have clawed its way deeper into affected systems.
This article[0] investigated the payload. It's a RAT, so it's capable of executing whatever shell commands it receives, instead of just stealing credentials.<p>[0]: <a href="https://safedep.io/axios-npm-supply-chain-compromise/" rel="nofollow">https://safedep.io/axios-npm-supply-chain-compromise/</a>
> March 31, around 01:00 UTC: community members file issues reporting the compromise. The attacker deletes them using the compromised account.<p>Interesting it got caught when it did.
I ask this on every supply chain security fail: Can we please mandate signing packages? Or at least commits?<p>NPM rejected PRs to support optional signing multiple times more than a decade ago now, and this choice has not aged well.<p>Anyone that cannot take 5 minutes to set up commit signing with a $40 usb smartcard to prevent impersonation has absolutely no business writing widely depended upon FOSS software.<p>Normalized negligence is still negligence.
I never understood why all the CAS tutorials pushed axios. This was before vite and build-scripts was how you did react. After the compromise I reviewed some projects and converted them to pure JS fetch and vite.
Does OIDC flow block this same issue of being able to use a RAT to publish a malicious package?
No. axios (v1 at least; not v0) were setup to publish via OIDC, but there's no option on npmjs for package maintainers to restrict their package to *only* using OIDC. The maintainer says his machine was infected via RAT, so if he was using software-based 2FA, nothing could have prevented this.
No, once the computer is compromised nothing really helps assuming the attacker is patient enough.
[dead]
[dead]
[dead]