3 ms·
That shouldn't be difficult to PoC. Although, following the tangent, other vectors targeting the js engine could be. At any rate, do you agree those issues wou
by efortis 6y ago
That shouldn't be difficult to PoC. Although, following the tangent, other vectors targeting the js engine could be.
At any rate, do you agree those issues would be unrelated to NPM scripts? I ask because my point is more like: one mitigation at a time. Otherwise, many people would do nothing because it wouldn't solve everything.
- forty 6y agoMaybe. I'll note that we do npm install in a separate gitlab-ci step as other steps that are running the code (we then share the modules via artifacts). Actually the publishing / deployment are also done in separate steps, so we could make sure that only the deployment step have the credentials (though I'm not sure it's possible with gitlab-ci atm) which would be a much better improvement than preventing npm scripts (which I'm still not convinced do bring more security without further improvements)
- efortis 6y agoWhen running `npm install` without the mitigation, the attacker can steal your source code right away, among other things. Also, developers adding new packages could compromise their environment because that's done running e.g. `npm install react`.