3 ms·
> a script to generate the package.json for an arbitrary package name Yep, that and it publishes your project to NPM!!! edit: I was wrong, the x.sh script loo
by rhinoceraptor 11y ago
> a script to generate the package.json for an arbitrary package name
Yep, that and it publishes your project to NPM!!!
edit: I was wrong, the x.sh script looks malicious but appears not to be? In any case it shows that installing NPM modules is just as unsafe as 'curl | sh'.
Ways to be safe are to first check what scripts will be run by a package: 'npm show $MODULE scripts'. There is also the '--ignore-scripts' flag[1].
[1]: https://blog.liftsecurity.io/2015/01/27/a-malicious-module-on-npm https://blog.liftsecurity.io/2015/01/27/a-malicious-module-o...
- jessaustin 11y agoIf you're logged in, if you call it with an argument that isn't already in use as a module name, and if you specifically enter the full path to the script (you don't have cwd on your $PATH, do you?). TFA would make more sense if it contained a warning not to run random scripts that one downloads without reading them. As it is, TFA seems like an attempt to invent malicious rumors about a completely innocent person. [EDIT:] you're still wrong; in order to be equivalent to "curl | sh", x.sh or its equivalent would have to be referenced in the "scripts" object in "package.json".
- SlashmanX 11y agoYou got any proof of that? I don't think there's anything malicious here. The file x is simply a list of the modules that were 'given up', and x.sh is used to loop through that list and republish them as placeholders, meaning other people can't use it for malicious purposes. The author seems to be in good standing and has even republished the original code to a few modules