2 ms·

they'd notice as soon as they tried to run their program as "import * from 'lodash'" would fail (unless they were consistent with their typos...)

• jtuchsen 11y ago
  You can inject a version of whatever you want into the node_modules folder in the post install script though can't you? So you just copy your own malicious lodash into node_modules. I haven't tried it but I think it'd work.
• goldbeck 11y ago
  what if it ran "npm install -g lodash"?