4 ms·
I am not familiar with Node or npm. Is there something specific to Node's package system that requires running untrusted code?
by bogomipz 8y ago
I am not familiar with Node or npm. Is there something specific to Node's package system that requires running untrusted code?
- lvh 8y agoNot really. Most dependencies get RCE one way or another, just not necessarily at installation.
- inapis 8y agoNot really. A lot of other package managers are vulnerable to the same kind of attacks seen on node/npm. It's just that a lot of npm packages can have an excessively long dependency chain which make it harder to audit. And the npm ecosystem is massive.