5 ms·
Once a package is “hijacked” like this, it might as well contain a spawn(...) command in the JS code.
by tobyhinloopen 6y ago
Once a package is “hijacked” like this, it might as well contain a spawn(...) command in the JS code.
- coffeefirst 6y agoRight. The scary part is not code you're running can do something bad. Of course it can. It's that given the depth of the dependency trees, I don't have any confidence we can tell the difference between trustworthy and untrustworthy packages.
- turminal 6y agoGiving up sadly appears to be the only option for most use cases of npm and the like.
- efortis 6y agoI agree, but that's a different attack vector, and doesn't render this mitigation useless. @haburka gave an example for that.