一句话：提出在运行时按包强制的最小权限系统，限制 npm 包对文件系统与网络 API 的访问，抵御恶意更新。
Node.js/npm 生态中存在大量第三方包，攻击者可通过向其依赖推送恶意更新来攻陷应用。作者在调研 npm 仓库时发现，许多被 Node.js 应用使用的包只做简单计算，并不需要访问文件系统或网络 API，这为按包实施最小权限设计提供了机会。为此，论文提出一种轻量级权限系统，在运行时对包权限进行强制，从而同时保护应用与包依赖免受恶意更新的侵害。文章还讨论了此类解决方案的设计空间，并表明该系统能让大量包变得难以被利用，且代价几乎可以忽略。
The large amount of third-party packages available in fast-moving software ecosystems, such as Node.js/npm, enables attackers to compromise applications by pushing malicious updates to their package dependencies. Studying the npm repository, we observed that many packages in the npm repository that are used in Node.js applications perform only simple computations and do not need access to filesystem or network APIs. This offers the opportunity to enforce least-privilege design per package, protecting applications and package dependencies from malicious updates. We propose a lightweight permission system that protects Node.js applications by enforcing package permissions at runtime. We discuss the design space of solutions and show that our system makes a large number of packages much harder to be exploited, almost for free.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{Ferreira0SK21,
title = {Containing Malicious Package Updates in npm with a Lightweight Permission System},
author = {Gabriel Ferreira and Limin Jia and Joshua Sunshine and Christian Kastner},
booktitle = {ICSE},
year = {2021},
doi = {10.1109/icse43902.2021.00121}
}