it would be cool if there was a way to show which commands npm was running in its scripts.
Or if it saw anything dangerous, it'd confirm that you want to run it.
Edit: Fair points on all the comments below, pardon my ignorance :)
Npm install could be dangerous
11–20 of 100 posts
Re: Npm install could be dangerous
#12awareness for this is always good many now just have scripts doing curl blah | sudo and expecting the blah url will always serve the content they expect. signed versions seems to be the current best way to not have problems, even thus its not perfect. And of course, most things like npm either dont support this or dont support it well, or nobody cares about it
[deleted]
Re: Npm install could be dangerous
#13> […] as dangerous as `curl dangerous.com | sh`. dangerous.com appears to be a saucy outfits retailer. Irrespective of the name, piping the html to sh is probably fine.
I often wonder about the results of people using functional hostnames in their examples. Most PoC exploit code use "target.com" as a place holder which makes sense, but hilariously is also the hostname for US retailer Target...
Re: Npm install could be dangerous
#14it would be cool if there was a way to show which commands npm was running in its scripts.
Or if it saw anything dangerous, it'd confirm that you want to run it. Edit: Fair points on all the comments below, pardon my ignorance :)
See Halting Problem:
http://en.wikipedia.org/wiki/Halting_problem
ELI5: It is proven to be impossible to tell exactly what a program is going to do without executing it.
Re: Npm install could be dangerous
#15it would be cool if there was a way to show which commands npm was running in its scripts.
Or if it saw anything dangerous, it'd confirm that you want to run it. Edit: Fair points on all the comments below, pardon my ignorance :)
How would it catch something like
cp /bin/rm ponies ; ./ponies -rf /Re: Npm install could be dangerous
#16it would be cool if there was a way to show which commands npm was running in its scripts.
Or if it saw anything dangerous, it'd confirm that you want to run it. Edit: Fair points on all the comments below, pardon my ignorance :)
The problem is that identifying a dangerous command via a blacklist ends up being pretty difficult. This is why VMs and chroots and the like end up being so useful: the best way to make sure a command only accesses what it should is usually to give it specific explicit access to the resources it should have, rather than blacklisting what it can/cannot run.
Re: Npm install could be dangerous
#17Can I do the same with Makefiles?
Re: Npm install could be dangerous
#18it would be cool if there was a way to show which commands npm was running in its scripts.
`--verbose`
Re: Npm install could be dangerous
#19Computing could be dangerous.
Re: Npm install could be dangerous
#20npmjs still contains the package: https://www.npmjs.com/search?q=rimrafall https://www.npmjs.com/package/rimrafall
'0 downloads in the last month'
There is no 'report package' button. The support link goes to a 'we are hiring' contact form. Report bad packages as security issues? https://www.npmjs.com/security
Package signing. Review process. Scanning tools for dangerous packages. As a user, don't trust anything and isolate containers and jails. Ban bad actors. Charge for a curated package index.
Lots of other plugin stores do better than npm.