Micropackages and Open Source Trust

Armin Ronacher shares his thoughts about the recent NPM left-pad issue:

When “pad left” disaster stroke I had a brief look at Sentry’s dependency tree. I should probably have done that before but for as long things work you don’t really tend to do that. At the time of writing we have 39 dependencies in our package.json. These dependencies are strongly vetted in the sense that we do not include anything there we did not investigate properly. What however we cannot do, is also to investigate every single dependency there is. The reason for this is how these node dependencies explode. While we have 39 direct dependencies, we have more than a thousand dependencies in total as it turns out.

Armin then talks about what he sees as the big problem, “Trust and Auditing”:

Say you build a program based on the Flask framework. You pull in a total of 4-5 dependencies for Flask alone which are all signed off my me. The attack vector to get untrusted code into Flask is:

• get a backdoor into a pull request and get it merged
• steal my credentials to PyPI and publish a new release with a backdoor
• put a backdoor into one of my dependencies

All of those attack vectors I cover. I use my own software, monitor what releases are PyPI which is also the only place to install my software from. I 2FA all my logins where possible, I use long randomly generated passwords where I cannot etc. None of my libraries use a dependency I do not trust the developer of. In essence if you use Flask you only need to trust me to not be malicious or idiotic. Generally by vetting me as a person (or maybe at a later point an organization that releases my libraries) you can be reasonably sure that what you install is what you expect and not something dangerous.

…

For instance sindresorhus maintains 827 npm packages. Most of which are probably one liners. I have no idea how good his opsec is, but my assumption is that it’s significantly harder for him to ensure that all of those are actually his releases than it is for me as I only have to look over a handful.

This is something that can affect any of package manager and something that indeed could be a disaster waiting to happen.