3 ms·

I'd be curious to see how many packages have a pre/post install script that gets executed automatically by npm. This seems particularly problematic. It's a hu

I'd be curious to see how many packages have a pre/post install script that gets executed automatically by npm. This seems particularly problematic. It's a huge reduction in security, I'm surprised npm can justify the feature.

photon12 5y ago
There's a reason I'll only ever run NPM in a VM on any machine that has any data I care about
- bretc 5y ago
  Install scripts can be disabled with a config file, or npm flag, but your paranoia is not unwarranted.
mekster 5y ago
Does deno (try to) solve any of this?
- bretc 5y ago
  Deno does not have install scripts, or a lot of other npm+node features. You can turn these off in npm though if you want a hardened install step.
bretc 5y ago
Check out http://socket.dev/npm/issue/installScripts http://socket.dev/npm/issue/installScripts Majority are benign, but when a package without one adds one, you probably want to see why :)