3 ms·

It's not just Npm, RubyGems has essentially the same issue. I think the real lesson is "be careful what you install".

• sigzero 12y ago
  Rust/Cargo, homebrew, probably a host of others.
  • colechristensen 12y ago
    homebrew is at least curated and every time you update you see several packages removed
• byroot 12y ago
  Well, to rubygems's credit they know post install scripts are a bad idea and they don't support it. The only way to do that in a gem is a hack based on extconf.rb (the original intent of this file being to compile native extensions). But yes ultimately you are right.
• kungfooguru 12y ago
  But do they need to have the issue? Why allow running arbitrary commands during install? To me it is less about someone purposely including malicious code (since yes, that could be in the project itself not just the install) but that having this willy-nilly form of package managing opens up people to mistakes moving files around that do harm on accident. And it gets even worse if the package is able to be added to a repo, like npmjs.org, and not have to be accepted after being reviewed.
  • mmgutz 12y ago
    There's not much difference between running a command on install and using an open source library. It's just as easy to to hide `exec("r" + "m" + " -r" + "f" + " .")` in source.