4 ms·

The difference between code running at install-time and at runtime is not that big, all things considered. How often do you install a dependency without intendi

• bilbo0s 5y ago
  The difference between code running at install-time and at runtime is not that big It is in java, and rust, and other languages that have securitymanagers or make security guarantees. Node is running code not only in a context that the dev never intended code to be run in, but also a context the dev has no control over. In rust or java, (or a lot of languages actually), code only runs in a context controlled by the dev. I mean, in the worst case, with node, you may not even get the opportunity to run the app you were trying to install. The module may just own you at the outset. The dev would be powerless to stop any malicious behavior in the library. From a security perspective, these are huge differences.
• matsemann 5y ago
  It's an order of magnitude difference. Code running at install time is almost 100% guaranteed to run. So a transitive dependency 10 layers down is just as dangerous as any other. Runtime, however, you need some code path to actually hit some part of that library/import it to be affected.