51–60 of 80 posts
Dependency installation should be a bit frictional...
That's interesting, tell me more?
I mean, wow. I've seen half-baked ideas before, but this takes the cake. Typos now equal remote code execution, and it's even easier to enter dependancy hell, because deps are now implicit.
Exactly how is any of this different than installing via the command line?
I mean, wow. I've seen half-baked ideas before, but this takes the cake. Typos now equal remote code execution, and it's even easier to enter dependancy hell, because deps are now implicit.
I actually looked at the code for 5 minutes. This module is vulnerable to arbitrary code execution simply by having a malicious JavaScript file in a directory or subdirectory underneath where `auto-install` is run, without the user even needing to make a typo due to its design. The documentation currently just says 'avoid typos'. siddharthkp: please give me a way to contact you. see my contact info on my profile.
So their security model is basically the same as with C: "do it perfectly the first time."
I mean, wow. I've seen half-baked ideas before, but this takes the cake. Typos now equal remote code execution, and it's even easier to enter dependancy hell, because deps are now implicit.
I actually looked at the code for 5 minutes. This module is vulnerable to arbitrary code execution simply by having a malicious JavaScript file in a directory or subdirectory underneath where `auto-install` is run, without the user even needing to make a typo due to its design. The documentation currently just says 'avoid typos'. siddharthkp: please give me a way to contact you. see my contact info on my profile.
Earlier quoted context omitted.
Right, but when you are running npm install you know you are installing and so you know you should be careful, and only hit return if you are sure it is right. With this, you have to be careful the WHOLE time you are typing. You normally don't worry about hitting return in your editor causing RCE.
If I understand correctly, this doesn't happen while you type, it happens after you save the file. Not much difference in care needed between saving a file or hitting enter IMO, if you are aware of the consequences. Also, its not like you don't know the thing is running - you'll subconsciously double check you typed the repo correctly before you save, knowing it will invoke an install.
Earlier quoted context omitted.
I actually looked at the code for 5 minutes. This module is vulnerable to arbitrary code execution simply by having a malicious JavaScript file in a directory or subdirectory underneath where `auto-install` is run, without the user even needing to make a typo due to its design. The documentation currently just says 'avoid typos'. siddharthkp: please give me a way to contact you. see my contact info on my profile.
They have an email address on their profile page.
https://news.ycombinator.com/user?id=siddharthkp doesn't return an email address, and I don't see one on the GitHub profile page either.
Earlier quoted context omitted.
They have an email address on their profile page.
Really? I don't see it. https://news.ycombinator.com/user?id=siddharthkp doesn't return an email address, and I don't see one on the GitHub profile page either.
I mean, wow. I've seen half-baked ideas before, but this takes the cake. Typos now equal remote code execution, and it's even easier to enter dependancy hell, because deps are now implicit.
I actually looked at the code for 5 minutes. This module is vulnerable to arbitrary code execution simply by having a malicious JavaScript file in a directory or subdirectory underneath where `auto-install` is run, without the user even needing to make a typo due to its design. The documentation currently just says 'avoid typos'. siddharthkp: please give me a way to contact you. see my contact info on my profile.
Earlier quoted context omitted.
I actually looked at the code for 5 minutes. This module is vulnerable to arbitrary code execution simply by having a malicious JavaScript file in a directory or subdirectory underneath where `auto-install` is run, without the user even needing to make a typo due to its design. The documentation currently just says 'avoid typos'. siddharthkp: please give me a way to contact you. see my contact info on my profile.
DM on twitter? I'm @siddharthkp