4 ms·
Development dependencies are especially terrifying because we generally don't use any sort of sandboxing. Any one of these dependencies could append to .bashrc
by ohazi 6y ago
Development dependencies are especially terrifying because we generally don't use any sort of sandboxing. Any one of these dependencies could append to .bashrc to get your computer to run literally anything, and then hide the evidence.
And developer machines are particularly juicy targets because they often have ssh keys to production machines lying around.
- lmeyerov 6y agoand even scarier if on a corp buildbox server that typically firewalls inbound, not outbound/lateral
- mike-cardwell 6y agoThis is precisely why I created https://gitlab.com/mikecardwell/safernode https://gitlab.com/mikecardwell/safernode - I can run "npm start" or "npm install" just like any other nodejs developer, but node is not installed on my host, and my .bashrc and any other files in my homedir are not at risk or being read or modified