https://kotlinlang.org logo
Join SlackCommunities
Powered by
I just started seeing this in my build logs for a ...
# javascript
c
I just started seeing this in my build logs for a Kotlin Multiplatform project that’s compiled to Javascript
Copy code
> Task :kotlinNpmInstall
warning workspace-aggregator-107d151b-247f-41fa-81dd-c9032d26021f > Project-lib-test > karma > ua-parser-js@0.7.29: this package has been hijacked
It looks like this is due to having karma used for my tests, e.g.
Copy code
js(IR) {
    browser {
        testTask {
            useKarma {
                useChromeHeadless()
                ...
It sounds like this is a security issue, but what’s the solution to either force the karma or ua-parser-js implicit dependency version?
b
Declare devNpm dependency on higher version of package to override
n
I had the same problem, and less than an hour later I realized that a malware (Crypto miner) had been installed on my machine. Seems to be a wrapped library from Kotlin multiplatform that use the package : ua-parser-js. This package has been hijacked : https://github.com/faisalman/ua-parser-js/issues/536 I recommend you to run a scan on your PC
r
It's a bit scary ... run some tests with your kotlin project - end up with lost passwords, crypto malware installed and "who knows what else", because some tiny npm project you've never heard about was compromised 😞
👍 5
b
What's even scarier is that linux is also affected
👍 2
n
Indeed, I am in the process of logging out of all my accounts to invalidate the sessions. I think my passwords are safe because they are stored in a password manager (BitWarden). For security I am also resetting my ssh key etc. But I have to admit that I'm a bit afraid to forget something important.
b
Thank god I'm always to lazy to write karma tests for my webapps
😀 1
c
I found that my desktop was using a cached version so I think I'm safe. I looked under build/js/node_modules/ua-parser-js/ and didn’t see the bad 0.7.29 version had been downloaded.
So if you’re not sure whether the bad version was downloaded, this could be something to check.
m
Is there an easy way to confirm/infirm a Gradle project has been exposed? There could be other packages beyond karma using this?
b
On linux run "ps -aux | grep jsextension"
🙏 1
c
I’m currently looking into how to prevent npm/yarn from executing arbitrary code when they download packages. There’s documentation on how to do that generally, but I’m trying to figure out if there’s anything special that needs to do when the Kotlin is invoking them.
n
On any machine, you can go to the build directory of your project and search for "jsextension". On windows, the name of the file is "jsextension.exe" and the description of it is not even trying to hide something :
@Carter if you find a way, im interested ! 🙂
unknown-4.png
c
At a high level, this is how it is done globally. But I’m trying to determine whether Kotlin respects that. Better would be figuring out what incantation to put into the Gradle DSL. Because that makes the project safer for everyone checking it out.
h
Did anyone create a ticket on youtrack with 
Security problem
?
nope 3
r
@hfhbd are you doing it? Or should I
h
Sorry for the delay, I created https://youtrack.jetbrains.com/issue/KT-49383
Workaround: Depend on a non affected version in your test dependencies. New projects will auto use the non-affected version 
0.7.30
.
Copy code
dependencies {
    testImplementation(kotlin("test"))
    testImplementation(npm("ua-parser-js", "0.7.30")) // 0.7.29 is affected
}
or disable script execution at all: single install: 
npm install --ignore-scripts
global config: 
npm config set ignore-scripts true
https://blog.npmjs.org/post/141702881055/package-install-scripts-vulnerability
👍 1
r
b
4 Views
Open in Slack
PreviousNext
Powered by