5 ms·
Node.js malware caught posting IPs, username, and device info on GitHub
- dave_aiello 6y agoDoes the npm Security Policy discussed at https://www.npmjs.com/policies/security https://www.npmjs.com/policies/security govern testing of all NodeJS modules that are available via npm, or does this policy relate to the software that provides the operational infrastructure for npm itself?
- Macha 6y agoSeems very clear to me that this relates to the npm client and backend services.
- Macha 6y agoI find this concerning in the context of the tendency for packages to promote the use of npx commands, where npx will just find and run the missing package name, so a typo means you have now just run different code than that what you intend in one command.
- mumblerino 6y agoBy default, “npm install” also has the ability to run code after the installation, so npx is not any less safe.