3 ms·
Do these npx business cards run arbitrary code on your computer?
by neilv 1y ago
Do these npx business cards run arbitrary code on your computer?
- cypherpunks01 1y agonpx Run a command from a local or remote npm package Description This command allows you to run an arbitrary command from an npm package (either one installed locally, or fetched remotely), in a similar context as running it via npm run.
- neilv 1y agoYes, then is a "command from an npm package" arbitrary code? And what is this "similar context as running it via npm run"? Would it be better to answer the question directly?
- joshka 1y agoYeah, this seems like a very smart but inherently flawed idea.
- cypherpunks01 1y agoYes I agree! OSS package management ecosystems are a great idea, but allowing submissions without any review or vetting is just asking for supply chain attacks.
- Xss3 1y agoMay as well just release an executable tbh.