4 ms·
One can protect from these kinds of vulnerabilities by setting ignore-scripts to true as default: npm config set ignore-scripts true yarn config set ignor
by notpublic 6y ago
One can protect from these kinds of vulnerabilities by setting ignore-scripts to true as default:
npm config set ignore-scripts true
yarn config set ignore-scripts true
https://blog.npmjs.org/post/141702881055/package-install-scripts-vulnerability https://blog.npmjs.org/post/141702881055/package-install-scr...
- msoad 6y agoWish they could simply disable this behavior! Or at least sandbox those scripts like Deno so if post install needs network or disk access, user has to specify a flag when installing
- kordlessagain 6y agoYou can also just not use npm!
- mushufasa 6y agoI tried this but then basic, very popular packages would fail to install properly. I couldn't even run npm start for my projects -- it would fail silently. So I had to revert because I couldn't get any work done. Was I just doing this wrong?
- bryanrasmussen 6y agotry npm install --ignore-scripts when first installing if problem, evaluate if you need to install that component and if look at the script.
- mushufasa 6y agoyes, and if i need the component then i have to run the scripts...
- notpublic 6y agoThere is no easy way to do it. Wish yarn/npm had an --allow-scripts flag. Anyway, this is what you could do. Find out which packages require postinstall scripts and then run it manually: $ grep postinstall node_modules/**/package.json node_modules/node-sass/package.json: "postinstall": "node scripts/build.js", $ cd node_modules/node-sass/ $ yarn run postinstall On the positive side, you get to know more about the dependency that you are trying to add :)