There has been a lot of pain at my various jobs installing a safe global npm config on every developer machine, asking people not to disable it, checking it with mdm tools. A safer out-of-the-box configuration is long overdue.
'No way to prevent this,' says only package manager where this regularly happens
51–60 of 230 posts
Re: 'No way to prevent this,' says only package manager where this regularly happens
#52There is no legitimate reason why postinstall scripts need to exist. The npm team needs to grow up and declare "starting with npm version whatever, npm will only run postinstall scripts for versions of packages published before ${today}".
install scripts are a distraction, just like package signatures are a distraction. adding/removing either feature has no significant impact on the wormability of this package ecosystem. installed npm code is run, with nearly zero exceptions.
The installed code may be run in different settings, under a different user, with different privileges. Say, it may not run in CI/CD at all, or run only with the test user's privileges.
Postinstall scripts run at install time, with installer's privileges.
Re: 'No way to prevent this,' says only package manager where this regularly happens
#53[flagged]
Re: 'No way to prevent this,' says only package manager where this regularly happens
#54There is no legitimate reason why postinstall scripts need to exist. The npm team needs to grow up and declare "starting with npm version whatever, npm will only run postinstall scripts for versions of packages published before ${today}".
This doesn't really fix the issue though because package code is also executed at build time and during testing. Just maybe restricts the scope a little bit.
If you look at the last N npm worms, they all used postinstall scripts.
Re: 'No way to prevent this,' says only package manager where this regularly happens
#55There has been a lot of pain at my various jobs installing a safe global npm config on every developer machine, asking people not to disable it, checking it with mdm tools. A safer out-of-the-box configuration is long overdue.
Just dont use npm. Use a package manager which doesn't execute postinstall by default. The switch is incredibly simple.
Re: 'No way to prevent this,' says only package manager where this regularly happens
#56There is no legitimate reason why postinstall scripts need to exist. The npm team needs to grow up and declare "starting with npm version whatever, npm will only run postinstall scripts for versions of packages published before ${today}".
There is also not too much legitimacy to the fact that Rust packages can run unsandboxed when they build themselves.
Re: 'No way to prevent this,' says only package manager where this regularly happens
#57Re: 'No way to prevent this,' says only package manager where this regularly happens
#58There has been a lot of pain at my various jobs installing a safe global npm config on every developer machine, asking people not to disable it, checking it with mdm tools. A safer out-of-the-box configuration is long overdue.
Just dont use npm. Use a package manager which doesn't execute postinstall by default. The switch is incredibly simple.
Which package manager is that, and what caveats does it offer?
Re: 'No way to prevent this,' says only package manager where this regularly happens
#59What are the actual guarantees that go/Rust make that Python/npm don’t? It seems like it might just be that Python/npm are juicier targets? I’m starting to try and avoid all third party packages
It is 100% up to the package manager's steward to control how ownership of packages and namespaces are granted. Maven Central exists for decades the amount of incidents of people stealing namespaces is minimal. One can't simply publish a package under the groupId "com.ycombinator" without having some way to verify that they own the domain ycombinator.com. Then, once a package is published, it is 100% immutable, even…
How does that protect against credential theft? MFA required to sign published releases?
Re: 'No way to prevent this,' says only package manager where this regularly happens
#60Earlier quoted context omitted.
If you look at the last N npm worms, they all used postinstall scripts.
Is that even true?
shai-hulud and variants
https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-s...