3 ms·
Npm has weak security boundaries. Basically any dependency can (used to?) run any script with the develop permissions on install. JVM and python package manage
by dtech 10mo ago
Npm has weak security boundaries.
Basically any dependency can (used to?) run any script with the develop permissions on install. JVM and python package managers don't do this.
Of course in all ecosystems once you actually run the code it can do whatever with the permissions of the executes program, but this is another hurdle.
- lights0123 10mo agoPython absolutely can run scripts in installation. Before pyproject.toml, arbitrary scripts were the only way to install a package. It's the reason PyPi.org doesn't show a dependency graph, as dependencies are declared in the Turing-complete setup.py.
- oefrha 10mo agoWrong. Wheels were available long before pyproject.toml, and you could instruct pip to only install from wheels. setup.py was needed to build the wheels, but the build step wasn’t a necessary part of installation and could be disabled. In that sense its role is similar to that of pre-publish build step of npm packages, unless wheels aren’t available.
- silverwind 10mo agoDeno has tackled some of these issues with their permission system, but afaik it can only be applied to apps, not to dependencies. What we really need is a system to restrict packages in what they can do (for example, many packages don't need network access).
- duncanbeevers 10mo agoLavamoat purports to do this. https://lavamoat.github.io/ https://lavamoat.github.io/ There has been some promising prior research such as BreakApp attempting to mitigate unusual supply-chain compromises such as denial-of-service attacks targeting the CPU via pathological regexps or other logic-bomb-flavored payloads.