4 ms·

This sucks for libraries that download native binaries in their install script. There are quite a few.

• junon 1y ago
  You can still whitelist them, though, and reinstall them.
• lrvick 1y ago
  Downloading binaries as part of an installation of a scripting language library should always be assumed to be malicious. Everything must be provided as source code and any compilation must happen locally.
  • oulipo2 1y ago
    Sure, but then you need to have a way to whitelist
    • lrvick 1y ago
      The whitelist is the package-lock.json of the hashes of libraries you or a security reviewer you trust has reviewed.