Npm install could be dangerous
github.com
Npm install could be dangerous
1–10 of 100 posts
Re: Npm install could be dangerous
#2it would be cool if there was a way to show which commands npm was running in its scripts.
Re: Npm install could be dangerous
#3Somehow I feel like using something that just simulates rm -rf /* would have brought the point across just as well and a bit safer...
Re: Npm install could be dangerous
#4It's not just Npm, RubyGems has essentially the same issue. I think the real lesson is "be careful what you install".
Re: Npm install could be dangerous
#5It's not just Npm, RubyGems has essentially the same issue. I think the real lesson is "be careful what you install".
Rust/Cargo, homebrew, probably a host of others.
Re: Npm install could be dangerous
#6I could just as easily embed something like that in any code on any open source project in any language as part of the installer or the main code base.
Re: Npm install could be dangerous
#7This applies to pretty much every pkg manager ever created.
That's why it's important to have end-to-end package signing with a reasonable UI, so people can choose to selectively trust the sources they need and get alerted before new dependencies get pulled in.
Sadly I don't know of any pkg manager that implements this correctly.
Re: Npm install could be dangerous
#8Somehow I feel like using something that just simulates rm -rf /* would have brought the point across just as well and a bit safer...
But not as fun
Re: Npm install could be dangerous
#9> […] as dangerous as `curl dangerous.com | sh`.
dangerous.com appears to be a saucy outfits retailer. Irrespective of the name, piping the html to sh is probably fine.
Re: Npm install could be dangerous
#10awareness for this is always good
many now just have scripts doing curl blah | sudo and expecting the blah url will always serve the content they expect.
signed versions seems to be the current best way to not have problems, even thus its not perfect.
And of course, most things like npm either dont support this or dont support it well, or nobody cares about it