Show HN: Auto install npm dependencies as you code

#1

Post by siddharthkp » Mon, Aug 08, 2016, 4:35 PM UTC

Show HN: Auto install npm dependencies as you code
npmjs.com

Re: Show HN: Auto install npm dependencies as you code

#2

Post by Rauchg » Mon, Aug 08, 2016, 4:57 PM UTC

Very cool! The Webpack equivalent: https://github.com/ericclemmons/npm-install-webpack-plugin

Re: Show HN: Auto install npm dependencies as you code

#3

Post by randallsquared » Mon, Aug 08, 2016, 5:02 PM UTC

Given that in npm v3 the order of installation determines where things are installed, this seems like it might cause some interesting bugs that never happen on the developer's machine. :)

Re: Show HN: Auto install npm dependencies as you code

#4

Post by akamel » Mon, Aug 08, 2016, 5:08 PM UTC

So I can make a malicious module called expres and another one called expresss and screw with ppls machines?

Re: Show HN: Auto install npm dependencies as you code

#5

Post by KirinDave » Mon, Aug 08, 2016, 5:16 PM UTC

Can you turn off the uninstall feature? I envision, "Nooooo, I was just refactoring! The network here is so slow noooooo please!"

Maven knows I've made the mistake of triggering a big download on a bad network.

Re: Show HN: Auto install npm dependencies as you code

#6

Post by joshstrange » Mon, Aug 08, 2016, 5:18 PM UTC

I am very interested in this for projects that I'm just starting and don't expect to run on anything but my machine. It's an annoying break of flow to be writing code and say "Crap, I need request or lodash" and have to stop, npm install --save, require, then go back to what I'm doing. Yes I still have to require it in but for side projects/one-offs I find this pretty cool.

Re: Show HN: Auto install npm dependencies as you code

#7

Post by concise_unicorn » Mon, Aug 08, 2016, 5:21 PM UTC

Regular expressions are a very naive way of detecting calls to 'require'. For correctness you're better off recursively walking the AST.

I've successfully used Detective in a couple of my personal projects to find all require statements.

Relevant issue on Detective: https://github.com/substack/node-detective/issues/8

Re: Show HN: Auto install npm dependencies as you code

#8

Post by lima » Mon, Aug 08, 2016, 5:21 PM UTC

akamel wrote: post #4

So I can make a malicious module called expres and another one called expresss and screw with ppls machines?

This.

Installing modules from npm is dangerous enough. Nice for education or playing around, unsuitable for a serious developers' workstation.

Re: Show HN: Auto install npm dependencies as you code

#9

Post by nathancahill » Mon, Aug 08, 2016, 5:25 PM UTC

Just when you thought dependency hell couldn't get any worse, it becomes automatic.

Re: Show HN: Auto install npm dependencies as you code

#10

Post by micaksica » Mon, Aug 08, 2016, 5:29 PM UTC

akamel wrote: post #4

So I can make a malicious module called expres and another one called expresss and screw with ppls machines?

This.

I love that the Node community enjoys innovating for convenience, but ideas like this one are less than half-baked from a security perspective. Just make a few typo'd popular packages, and use npm install scripts [1] and you have a very easy remote code execution vector on developer workstations.

The bigger problem I see is that npm is a circus. No package signing and a ridiculous debate on why that's been going on for a year and a half [2]. Credentials leaks of popular modules. [3]

When everything is a module and everyone is supposed to include modules vs. writing their own very simple functionality for things even like isArray polyfills [4] (24MM downloads a month!), you end up with the same attack surface that gives WordPress such a shitty reputation for security. It's not usually core, it's all the plugins by authors of unknown provenance and skill. WordPress gets pwned because there are a lot of plugins hastily written by new developers and used without audit by mom-and-pop web app shops and/or those that trust the code because they aren't capable of auditing it meaningfully.

When you use an npm dependency, you are taking on all of their dependencies. You are trusting they don't leak creds, that npm has not been compromised, and that the chain underneath has been audited for malicious behavior. In reality this is impractical: go npm install express and see just how deep the dependency chain goes. Things like Snyk are required to just understand what might be vulnerable.

[1] https://docs.npmjs.com/misc/scripts

[2] https://github.com/node-forward/discussions/issues/29

[3] https://github.com/ChALkeR/notes/blob/master/Do-not-underest...

[4] https://www.npmjs.com/package/isarray

EDIT: Ironically, this module itself is vulnerable to code injection.