5 ms·

pnpm v10 disables all lifecycle scripts by default and requires the user to whitelist packages. https://github.com/orgs/pnpm/discussions/8945 https://github.co

pnpm v10 disables all lifecycle scripts by default and requires the user to whitelist packages. https://github.com/orgs/pnpm/discussions/8945 https://github.com/orgs/pnpm/discussions/8945

chrisweekly 11mo ago
One of the many reasons there is no good reason to use npm; pnpm is better in every way.
sroussey 11mo ago
It’s just security theater in the end. You can just as easily put all that stuff in the package files since a package is installed to run code. You have that code then do all the sketchy stuff. What’s needed is an entitlements system so a package you install doesn’t do runtime stuff like install crypto mining software. Even then…
- theodorejb 11mo ago
  I would expect to be able to download a package and then inspect the code before I decide to import/run any of the package files. But npm by default will run arbitrary code in the package before developers have a chance to inspect it, which can be very surprising and dangerous.
  - sroussey 11mo ago
    npm used to do that. bun never did. No idea about the past for pnpm or yarn.
- Mogzol 11mo ago
  A package, especially a javascript package, is not necessarily installed to run code, at least not on the machine installing the package. Many packages will only be run in the browser, which is already a fairly safe environment compared to running directly on the machine like lifecycle scripts would. So preventing lifecycle scripts certainly limits the number of packages that could be exploited to get access to the installing machine. It's common for javascript apps to have hundreds of dependencies, but only a handful of them will ever actually run as code on the machine that installed them.
  - sroussey 11mo ago
    True… I do a lot of server or universal code. But don’t trust browser code either. Could be connecting to MetaMask and stealing crypto, running mining software, or injecting ads. And with node you get files and the ability run arbitrary code on arbitrary processes.
theodorejb 11mo ago
Bun also doesn't execute lifestyle scripts by default, except for a customizable whitelist of trusted dependencies: https://bun.com/docs/guides/install/trusted https://bun.com/docs/guides/install/trusted
- codedokode 11mo ago
  "Trusted" dependencies are poor solution, the good solution is either never run scripts, or run them inside qemu.
ehutch79 11mo ago
Also, you can now pin versions in that whitelist
chuckadams 11mo ago
PHP composer does the same, in config.allow-plugins.<package> in composer.json. The default behavior is to prompt, with an "always" option to add the entry to composer.json. It's baffling that npm and yarn just let the scripts run with nary a peep.
codedokode 11mo ago
Finally sane solution. When I was thinking about package manager design, I also thought that there should be no scripts, the package manager should just download files and that's all.

pnpm v10 disables all lifecycle scripts by default and requires the user to whitelist packages. https://github.com/orgs/pnpm/discussions/8945 https://github.com/orgs/pnpm/discussions/8945

chrisweekly 11mo ago

One of the many reasons there is no good reason to use npm; pnpm is better in every way.

sroussey 11mo ago

It’s just security theater in the end. You can just as easily put all that stuff in the package files since a package is installed to run code. You have that code then do all the sketchy stuff. What’s needed is an entitlements system so a package you install doesn’t do runtime stuff like install crypto mining software. Even then…

theodorejb 11mo ago
I would expect to be able to download a package and then inspect the code before I decide to import/run any of the package files. But npm by default will run arbitrary code in the package before developers have a chance to inspect it, which can be very surprising and dangerous.
- sroussey 11mo ago
  npm used to do that. bun never did. No idea about the past for pnpm or yarn.
Mogzol 11mo ago
A package, especially a javascript package, is not necessarily installed to run code, at least not on the machine installing the package. Many packages will only be run in the browser, which is already a fairly safe environment compared to running directly on the machine like lifecycle scripts would. So preventing lifecycle scripts certainly limits the number of packages that could be exploited to get access to the installing machine. It's common for javascript apps to have hundreds of dependencies, but only a handful of them will ever actually run as code on the machine that installed them.
- sroussey 11mo ago
  True… I do a lot of server or universal code. But don’t trust browser code either. Could be connecting to MetaMask and stealing crypto, running mining software, or injecting ads. And with node you get files and the ability run arbitrary code on arbitrary processes.

theodorejb 11mo ago

Bun also doesn't execute lifestyle scripts by default, except for a customizable whitelist of trusted dependencies: https://bun.com/docs/guides/install/trusted https://bun.com/docs/guides/install/trusted

codedokode 11mo ago
"Trusted" dependencies are poor solution, the good solution is either never run scripts, or run them inside qemu.

ehutch79 11mo ago

Also, you can now pin versions in that whitelist

chuckadams 11mo ago

PHP composer does the same, in config.allow-plugins.<package> in composer.json. The default behavior is to prompt, with an "always" option to add the entry to composer.json. It's baffling that npm and yarn just let the scripts run with nary a peep.

codedokode 11mo ago

Finally sane solution. When I was thinking about package manager design, I also thought that there should be no scripts, the package manager should just download files and that's all.