3 ms·

Overly dramatic. The content is not suspicious at all, it's clearly a script to generate the package.json for an arbitrary package name passed in as an argument

by pluma 11y ago

Overly dramatic. The content is not suspicious at all, it's clearly a script to generate the package.json for an arbitrary package name passed in as an argument to the script. I'm guessing @nj48 used a script to go over the official list of unpublished modules and attempt to generate a placeholder for each of them. The same user also published some actual (unmanipulated) forks of the original modules, so I'm guessing this is mostly a quick move to preempt any malicious hijacking by others. There is no reason to assume the "hijacking" is malicious. Certainly not in the scripts. The user is active on GitHub and shows no indication of malicious intent. However it IS worth pointing out that the unpublished modules should now be treated with caution if you still rely on them because even if the replacements are identical and benevolent you probably need to take action.

rhinoceraptor 11y ago
> a script to generate the package.json for an arbitrary package name Yep, that and it publishes your project to NPM!!! edit: I was wrong, the x.sh script looks malicious but appears not to be? In any case it shows that installing NPM modules is just as unsafe as 'curl | sh'. Ways to be safe are to first check what scripts will be run by a package: 'npm show $MODULE scripts'. There is also the '--ignore-scripts' flag[1]. [1]: https://blog.liftsecurity.io/2015/01/27/a-malicious-module-on-npm https://blog.liftsecurity.io/2015/01/27/a-malicious-module-o...
- jessaustin 11y ago
  If you're logged in, if you call it with an argument that isn't already in use as a module name, and if you specifically enter the full path to the script (you don't have cwd on your $PATH, do you?). TFA would make more sense if it contained a warning not to run random scripts that one downloads without reading them. As it is, TFA seems like an attempt to invent malicious rumors about a completely innocent person. [EDIT:] you're still wrong; in order to be equivalent to "curl | sh", x.sh or its equivalent would have to be referenced in the "scripts" object in "package.json".
- SlashmanX 11y ago
  You got any proof of that? I don't think there's anything malicious here. The file x is simply a list of the modules that were 'given up', and x.sh is used to loop through that list and republish them as placeholders, meaning other people can't use it for malicious purposes. The author seems to be in good standing and has even republished the original code to a few modules

by pluma 11y ago

rhinoceraptor 11y ago

> a script to generate the package.json for an arbitrary package name Yep, that and it publishes your project to NPM!!! edit: I was wrong, the x.sh script looks malicious but appears not to be? In any case it shows that installing NPM modules is just as unsafe as 'curl | sh'. Ways to be safe are to first check what scripts will be run by a package: 'npm show $MODULE scripts'. There is also the '--ignore-scripts' flag[1]. [1]: https://blog.liftsecurity.io/2015/01/27/a-malicious-module-on-npm https://blog.liftsecurity.io/2015/01/27/a-malicious-module-o...

jessaustin 11y ago
If you're logged in, if you call it with an argument that isn't already in use as a module name, and if you specifically enter the full path to the script (you don't have cwd on your $PATH, do you?). TFA would make more sense if it contained a warning not to run random scripts that one downloads without reading them. As it is, TFA seems like an attempt to invent malicious rumors about a completely innocent person. [EDIT:] you're still wrong; in order to be equivalent to "curl | sh", x.sh or its equivalent would have to be referenced in the "scripts" object in "package.json".
SlashmanX 11y ago
You got any proof of that? I don't think there's anything malicious here. The file x is simply a list of the modules that were 'given up', and x.sh is used to loop through that list and republish them as placeholders, meaning other people can't use it for malicious purposes. The author seems to be in good standing and has even republished the original code to a few modules