3 ms·
This is why I every time I install something that uses NPM, I create a dedicated user account for it. Although even if NPM scripts only have access to files th
by csense 11y ago
This is why I every time I install something that uses NPM, I create a dedicated user account for it.
Although even if NPM scripts only have access to files they need to access, the damage is bad enough (e.g. if some malicious dependency of a dependency of a dependency checks if it can find a DOM and if so siphon off a copy of every password field to the attacker, every user of your website has just been compromised even if your server's /usr/bin directory is safe).
- feduzi 11y agoA dedicated user account... wow (https://www.exploit-db.com/local/ https://www.exploit-db.com/local/). In this amount of software people build and considering that really 90% of it is total crap, we'll never be secure unless we really be picky with what we use. But that does not work with our lazy nature and all that things about bicycles you hear (like not to invent one; why would I do something by myself if I can just use someone's else solution... duhhh). We need better quality in our software, so we can trust it.