3 ms·
What I want to know is how many systems does the author of is-positive-integer have implicit root access to? Sounds to me like publishing oneliners on NPM is a
by xorcist 11y ago
What I want to know is how many systems does the author of is-positive-integer have implicit root access to?
Sounds to me like publishing oneliners on NPM is a trivial way to build a botnet.
- insin 11y agoSeems like the answer is "none" by default, from https://docs.npmjs.com/misc/scripts#user https://docs.npmjs.com/misc/scripts#user > If npm was invoked with root privileges, then it will change the uid to the user account or uid specified by the user config, which defaults to nobody. Set the unsafe-perm flag to run scripts with root privileges.
- xorcist 11y agoThat's good, even if nobody is perfectly enough to a botnet. I thought more of the user running the node application.