4 ms·

> I don't really see the big deal here Here's an idea: someone sends a dev at some company, or even a freelancer, some code. Code references a module with a ma

> I don't really see the big deal here Here's an idea: someone sends a dev at some company, or even a freelancer, some code. Code references a module with a malicious npm package (say, with a postinstall script). Dev opens it in zed Now, my untrusted code is running on your machine, probably without your knowledge

broeng 2y ago
Why the hell does npm support a postinstall script? There really shouldn't be a need to run arbitrary code provided by the package for something like this.
- ErikBjare 2y ago
  It also supports preinstall and install scripts, for more obvious reasons.
  - broeng 2y ago
    I don't really think thats more obvious. It's expected to install dev libraries, not system services, it shouldn't have that need.
    - deafpolygon 2y ago
      dependency checking isn't simple
    - andyferris 2y ago
      NodeJS isn't very sandboxed. Many "dev libraries" are native and will either download and link to binary blobs, or build e.g. C code, which AFAICT is what all the various install scripts are for.
      - broeng 2y ago
        It seems like a bad design choice, that, besides allowing for running untrusted code directly at download time, also makes it difficult to properly mirror artifacts, and I'd assume, make platform portability inconsistent, at best.
- nijave 2y ago
  The package itself is arbitrary code. You're running arbitrary code either way whether it's preinstall, install, post install, or when the package code gets ran. It's common to need to setup tool chains for code that gets compiled (i.e. a node module that adds language bindings to a C library)
nijave 2y ago
>someone sends a dev at some company, or even a freelancer, some code The code itself could be malicious and have backdoors. Really you shouldn't run anything untrusted outside a sandbox or some other form of isolation
alfiedotwtf 2y ago
How is that any different from the VS Code extensions that have one star and are just copies of other extensions… waiting to get high stars and then switch-a-roo? Same goes for browser extensions. Unless you’re auditing everything while taking Trusting Trust into account, you’re drawing the line somewhere saying “ok I can’t be bothered past this point verifying”. … everyone has a line somewhere on the trust-but-verify spectrum
- wtetzner 2y ago
  > … everyone has a line somewhere on the trust-but-verify spectrum Sure, and by making the automatic downloads optional, users are given the choice of where they want to draw that line.

broeng 2y ago

Why the hell does npm support a postinstall script? There really shouldn't be a need to run arbitrary code provided by the package for something like this.

ErikBjare 2y ago
It also supports preinstall and install scripts, for more obvious reasons.
- broeng 2y ago
  I don't really think thats more obvious. It's expected to install dev libraries, not system services, it shouldn't have that need.
  - deafpolygon 2y ago
    dependency checking isn't simple
  - andyferris 2y ago
    NodeJS isn't very sandboxed. Many "dev libraries" are native and will either download and link to binary blobs, or build e.g. C code, which AFAICT is what all the various install scripts are for.
    - broeng 2y ago
      It seems like a bad design choice, that, besides allowing for running untrusted code directly at download time, also makes it difficult to properly mirror artifacts, and I'd assume, make platform portability inconsistent, at best.
nijave 2y ago
The package itself is arbitrary code. You're running arbitrary code either way whether it's preinstall, install, post install, or when the package code gets ran. It's common to need to setup tool chains for code that gets compiled (i.e. a node module that adds language bindings to a C library)

nijave 2y ago

>someone sends a dev at some company, or even a freelancer, some code The code itself could be malicious and have backdoors. Really you shouldn't run anything untrusted outside a sandbox or some other form of isolation

alfiedotwtf 2y ago

How is that any different from the VS Code extensions that have one star and are just copies of other extensions… waiting to get high stars and then switch-a-roo? Same goes for browser extensions. Unless you’re auditing everything while taking Trusting Trust into account, you’re drawing the line somewhere saying “ok I can’t be bothered past this point verifying”. … everyone has a line somewhere on the trust-but-verify spectrum

wtetzner 2y ago
> … everyone has a line somewhere on the trust-but-verify spectrum Sure, and by making the automatic downloads optional, users are given the choice of where they want to draw that line.