4 ms·
I actually looked at the code for 5 minutes. This module is vulnerable to arbitrary code execution simply by having a malicious JavaScript file in a directory o
by micaksica 10y ago
I actually looked at the code for 5 minutes. This module is vulnerable to arbitrary code execution simply by having a malicious JavaScript file in a directory or subdirectory underneath where `auto-install` is run, without the user even needing to make a typo due to its design.
The documentation currently just says 'avoid typos'.
siddharthkp: please give me a way to contact you. see my contact info on my profile.
- krapp 10y ago>The documentation currently just says 'avoid typos'. So their security model is basically the same as with C: "do it perfectly the first time."
- pavel_lishin 10y agoThey have an email address on their profile page.
- micaksica 10y agoReally? I don't see it. https://news.ycombinator.com/user?id=siddharthkp https://news.ycombinator.com/user?id=siddharthkp doesn't return an email address, and I don't see one on the GitHub profile page either.
- pavel_lishin 10y agohttps://www.npmjs.com/~siddharthkp https://www.npmjs.com/~siddharthkp
- micaksica 10y agoThanks. Reaching out.
- siddharthkp 10y agoDM on twitter? I'm @siddharthkp
- micaksica 10y agoYour DMs are closed.
- siddharthkp 10y agoSorry about that, fixed.