3 ms·
Building my npx business card
- steele 1y agoOoh, free real estate, let's colonize and gentrify package management
- aabhay 1y agoLmao, gentrify cracked me up
- neilv 1y agoDo these npx business cards run arbitrary code on your computer?
- cypherpunks01 1y agonpx Run a command from a local or remote npm package Description This command allows you to run an arbitrary command from an npm package (either one installed locally, or fetched remotely), in a similar context as running it via npm run.
- neilv 1y agoYes, then is a "command from an npm package" arbitrary code? And what is this "similar context as running it via npm run"? Would it be better to answer the question directly?
- joshka 1y agoYeah, this seems like a very smart but inherently flawed idea.
- cypherpunks01 1y agoYes I agree! OSS package management ecosystems are a great idea, but allowing submissions without any review or vetting is just asking for supply chain attacks.
- Xss3 1y agoMay as well just release an executable tbh.
- theamk 1y agoReminds me of JAPH [0] - a tiny Perl program that was used in email/newsgroup signature to give it personal touch. [0] https://www.perlmonks.org/?node_id=412464 https://www.perlmonks.org/?node_id=412464
- watusername 1y agoTerminal business cards are a nice idea, but RCE business cards are just asking for trouble. Instead of npx, what happened to good'ol curl? Something like $ curl ashley.dev Some decades ago, we had finger (https://en.wikipedia.org/wiki/Finger_%28protocol%29 https://en.wikipedia.org/wiki/Finger_%28protocol%29) which is designed for this very use case. Sadly it's no longer installed by default with most distros: $ finger @ashley.dev
- queezey 1y agoThis would be a great advertisement for security consulting. "I was just able to run arbitrary code on your computer. Here is a sample of your recent browser history. Let me tell you help you mitigate your security vulnerabilities."