3 ms·
Before NPMv7, enabling `ignore-scripts` also disabled NPM scripts, which are needed for this attack vector. Currently, you can avoid using NPM scripts, and in
by efortis 4y ago
Before NPMv7, enabling `ignore-scripts` also disabled NPM scripts, which are needed for this attack vector.
Currently, you can avoid using NPM scripts, and in effect avoiding this vulnerability, by using a shell script or a Makefile. For example:
https://blog.uidrafter.com/getting-rid-of-npm-scripts https://blog.uidrafter.com/getting-rid-of-npm-scripts