2 ms·

i don't understand your point about random npm account holders running their scripts on your computer?

• 0x0 6y ago
  When you npm install a single package like vue or react, it drags in a dependency tree that sources a thousand random npmjs packages. Each of these packages may specify a postinstall script that executes at install time. Time and time again, some random leftpad-like dependency might lurk five directories deep and spring a surprise script on you, either because the author is malicious, or they handed over (or sold out) to someone else, or perhaps most likely their npmjs account was simply compromised.
  • cdelsolar 6y ago
    gotcha. oof. :/