{"action":"created","issue":{"url":"https://api.github.com/repos/bcoin-org/bcoin/issues/619","repository_url":"https://api.github.com/repos/bcoin-org/bcoin","labels_url":"https://api.github.com/repos/bcoin-org/bcoin/issues/619/labels{/name}","comments_url":"https://api.github.com/repos/bcoin-org/bcoin/issues/619/comments","events_url":"https://api.github.com/repos/bcoin-org/bcoin/issues/619/events","html_url":"https://github.com/bcoin-org/bcoin/issues/619","id":369345531,"node_id":"MDU6SXNzdWUzNjkzNDU1MzE=","number":619,"title":"Security of dependencies","user":{"login":"braydonf","id":544777,"node_id":"MDQ6VXNlcjU0NDc3Nw==","avatar_url":"https://avatars3.githubusercontent.com/u/544777?v=4","gravatar_id":"","url":"https://api.github.com/users/braydonf","html_url":"https://github.com/braydonf","followers_url":"https://api.github.com/users/braydonf/followers","following_url":"https://api.github.com/users/braydonf/following{/other_user}","gists_url":"https://api.github.com/users/braydonf/gists{/gist_id}","starred_url":"https://api.github.com/users/braydonf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/braydonf/subscriptions","organizations_url":"https://api.github.com/users/braydonf/orgs","repos_url":"https://api.github.com/users/braydonf/repos","events_url":"https://api.github.com/users/braydonf/events{/privacy}","received_events_url":"https://api.github.com/users/braydonf/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-10-11T23:36:13Z","updated_at":"2018-11-28T21:01:27Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"As of v1.0.2 of bcoin, dependencies are not locked to a specific hash, and can be installed with _any_ matching version regardless of what code there might be associated with that version.\r\n\r\nAside from one's own diligence and review of dependencies, bcoin installation would, at best, inherit the security of the npmjs repository. There have been known with executed attacks against the repository (see https://eslint.org/blog/2018/07/postmortem-for-malicious-package-publishes).\r\n\r\nFurthermore, there are _many_ development dependencies that have not been published in over a year, and therefore have not upgraded to use secure hash functions, as there has been known and practices collision attacks against sha1 (see https://shattered.io/) for over a year. So even with a package lockfile there would still be issues.\r\n\r\nFrom discussion with npmjs security about mitigating issues with sha1, there is possible migration process, however it has not yet been made a priority there.\r\n\r\nI've opened a PR to add a lockfile and move development dependencies that would be then required to be manually installed, however there hasn't been activity or review (see https://github.com/bcoin-org/bcoin/pull/569).\r\n\r\nWhat are the next steps?"},"comment":{"url":"https://api.github.com/repos/bcoin-org/bcoin/issues/comments/442603058","html_url":"https://github.com/bcoin-org/bcoin/issues/619#issuecomment-442603058","issue_url":"https://api.github.com/repos/bcoin-org/bcoin/issues/619","id":442603058,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MjYwMzA1OA==","user":{"login":"braydonf","id":544777,"node_id":"MDQ6VXNlcjU0NDc3Nw==","avatar_url":"https://avatars3.githubusercontent.com/u/544777?v=4","gravatar_id":"","url":"https://api.github.com/users/braydonf","html_url":"https://github.com/braydonf","followers_url":"https://api.github.com/users/braydonf/followers","following_url":"https://api.github.com/users/braydonf/following{/other_user}","gists_url":"https://api.github.com/users/braydonf/gists{/gist_id}","starred_url":"https://api.github.com/users/braydonf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/braydonf/subscriptions","organizations_url":"https://api.github.com/users/braydonf/orgs","repos_url":"https://api.github.com/users/braydonf/repos","events_url":"https://api.github.com/users/braydonf/events{/privacy}","received_events_url":"https://api.github.com/users/braydonf/received_events","type":"User","site_admin":false},"created_at":"2018-11-28T21:01:27Z","updated_at":"2018-11-28T21:01:27Z","author_association":"CONTRIBUTOR","body":"Okay cool, was taking a look at something similar based on a minimal test bootstrap from: https://github.com/braydonf/chainbeacon/blob/master/test/bootstrap.js"}}
{"actor":{"display_login":"braydonf"}}