3 ms·
NPM bin script confusion: Abusing ‘bin’ to hijack ‘node’ command
- efortis 4y agoBefore NPMv7, enabling `ignore-scripts` also disabled NPM scripts, which are needed for this attack vector. Currently, you can avoid using NPM scripts, and in effect avoiding this vulnerability, by using a shell script or a Makefile. For example: https://blog.uidrafter.com/getting-rid-of-npm-scripts https://blog.uidrafter.com/getting-rid-of-npm-scripts