4 ms·
Put `ignore-scripts=true` in your .npmrc
by theteapot 2y ago
Put `ignore-scripts=true` in your .npmrc
- gruez 2y agothat just delays the exploit. The exploit can still run next time you import the file.
- theteapot 2y agoThis mostly defends against name squatting and other malicious dependencies that never get imported. Haven't reviewed code but article says its entry point is install script. install scripts don't run on import. I guess you saying it triggers from import too.