3 ms·
Why are install scripts so scary? `install: "malware"` is a few steps closer to running than `cp.exec('malware')` in index.js.
by seniorsassycat 5y ago
Why are install scripts so scary?
`install: "malware"` is a few steps closer to running than `cp.exec('malware')` in index.js.
- alerighi 5y agoBecause it's not always the case that the code runs inside your machine. For example a package that runs inside a web browser can't do a lot of damage since it's sandboxed, however the install scripts always run on the target machine. Also the install script may run with higher privileges than the one that the program would have when it's executed. For example there is the case of installing packages globally with root privileges, ideally something that you shouldn't do, but how many people runs `sudo npm i -g something`? In that case the install script runs with root privileges. Of course there are rare cases when they are needed: but that cases should be an opt-in, meaning that the user is prompted to run the script (if running interactively) or the user has to provide a command line option to allow specific packages to run scripts, or add an option in the package.json to whitelist specific packages.