Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add windows/darwin support to npm_packages #7536

Merged
merged 10 commits into from
Mar 30, 2022

Conversation

terracatta
Copy link
Contributor

@terracatta terracatta commented Mar 27, 2022

What Does This PR Do?

This PR does three things:

  1. improves the npm_packages table so that it runs on every compatible osquery platform (including Windows and macOS).
  2. Adds the homepage key from the package.json file to the schema as a new column.
  3. Improves the default directory search list based on my independent research finding the default paths of node modules on Mac, windows, and linux devices.

Default run on macOS

osquery> select * from npm_packages;
       name = npm
    version = 8.5.5
description = a package manager for JavaScript
     author = Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)
    license = Artistic-2.0
   homepage = https://docs.npmjs.com/
       path = /opt/homebrew/lib/node_modules/npm/package.json
  directory = /opt/homebrew/lib/

Run on macOS with custom directory

osquery> select name, version, description from npm_packages where directory = "Users/jmeller/code/kolide/k2/" and name LIKE "c%" limit 3;
+----------------------+---------+-----------------------------------------------+
| name                 | version | description                                   |
+----------------------+---------+-----------------------------------------------+
| canvas-confetti      | 0.4.2   | performant confetti animation in the browser  |
| chart.js             | 2.9.4   | Simple HTML5 charts using the canvas element. |
| chartjs-color-string | 0.6.0   | Parser and generator for CSS color strings    |
+----------------------+---------+-----------------------------------------------+

Default Run on Windows 10

osquery> SELECT * FROM npm_packages;
       name = tldr
    version = 3.3.7
description = Simplified and community-driven man pages
     author = Romain Prieto
    license = MIT
   homepage = http://tldr-pages.github.io
       path = C:\Users\jason\AppData\Roaming\npm\node_modules\tldr\package.json
  directory = C:\Users\jason\AppData\Roaming\npm\

       name = yarn
    version = 1.22.18
description = 📦🐈 Fast, reliable, and secure dependency management.
     author =
    license = BSD-2-Clause
   homepage =
       path = C:\Users\jason\AppData\Roaming\npm\node_modules\yarn\package.json
  directory = C:\Users\jason\AppData\Roaming\npm\

Why Is This Useful?

There have been a number of high-profile supply-chain attacks involving npm_packages. While the current table can help locate compromised packages in production environments, it's also useful to scan for them on a developer's device directly. Many NPM packages can be installed globally and are available in the the user's $PATH.

By expanding to more operating systems, we can drastically improve detection of these nefarious packages.

Implementation

This PR mostly apes the cross-platform implementation of the python_packages table and combines in all the previous work done on this table under linux.

@terracatta terracatta requested review from a team as code owners March 27, 2022 19:21
Copy link
Member

@directionless directionless left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Small nit from me, but I'll leave the review to a non-coworker

Copy link
Member

@sharvilshah sharvilshah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @terracatta! This is super useful -- I think there is only one small merge conflict to be resolved

@terracatta
Copy link
Contributor Author

@sharvilshah I fixed the conflict, I'm not sure why that one test failed it looks like it was just a random timeout?

@Smjert
Copy link
Member

Smjert commented Mar 30, 2022

@sharvilshah I fixed the conflict, I'm not sure why that one test failed it looks like it was just a random timeout?

I've kicked a new build and yeah, it's a known flaky test.

@directionless
Copy link
Member

GitHub status says mac actions are being slooooowwwww

@directionless directionless merged commit 11b670d into osquery:master Mar 30, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants