4 ms·
But they can't be stealing any identifying information right? At best it can count the number of times the package was downloaded. Isn't the solution for npm
by avita1 11y ago
But they can't be stealing any identifying information right? At best it can count the number of times the package was downloaded.
Isn't the solution for npm to have tighter controls on where it will download packages from?
- STRML 11y agoIt depends on whether or not it actually delivers a payload. If it does, then it can use a `postinstall` hook to execute absolutely anything it wants, under the context of the user. This is why you should always shrinkwrap and run a private npm repository in production. Anything less is opening you up to remote takeover at the whim of a single package publisher.