News for hackers. Stuff that matters.

A comment on Show HN: Auto install npm dependencies as you code. Parent comment

Re:Show HN: Auto install npm dependencies as you code by micaksica on Monday August 08, 2016 @02:26PM (#12249825)
I actually looked at the code for 5 minutes. This module is vulnerable to arbitrary code execution simply by having a malicious JavaScript file in a directory or subdirectory underneath where `auto-install` is run, without the user even needing to make a typo due to its design.

The documentation currently just says 'avoid typos'.

siddharthkp: please give me a way to contact you. see my contact info on my profile.

[ Parent | on HN ]
Re:Show HN: Auto install npm dependencies as you code by krapp on Monday August 08, 2016 @02:36PM (#12249903)
>The documentation currently just says 'avoid typos'.

So their security model is basically the same as with C: "do it perfectly the first time."

[ Parent | on HN ]
Re:Show HN: Auto install npm dependencies as you code by siddharthkp on Monday August 08, 2016 @02:41PM (#12249936)
DM on twitter? I'm @siddharthkp
[ Parent | on HN ]
Re:Show HN: Auto install npm dependencies as you code by micaksica on Monday August 08, 2016 @02:42PM (#12249947)
Your DMs are closed.
[ Parent | on HN ]
Re:Show HN: Auto install npm dependencies as you code by siddharthkp on Monday August 08, 2016 @02:52PM (#12250008)
Sorry about that, fixed.
[ Parent | on HN ]
Re:Show HN: Auto install npm dependencies as you code by pavel_lishin on Monday August 08, 2016 @02:38PM (#12249913)
They have an email address on their profile page.
[ Parent | on HN ]
Re:Show HN: Auto install npm dependencies as you code by micaksica on Monday August 08, 2016 @02:40PM (#12249924)
Really? I don't see it.

https://news.ycombinator.com/user?id=siddharthkp doesn't return an email address, and I don't see one on the GitHub profile page either.

[ Parent | on HN ]
Re:Show HN: Auto install npm dependencies as you code by pavel_lishin on Monday August 08, 2016 @02:41PM (#12249933)
https://www.npmjs.com/~siddharthkp
[ Parent | on HN ]
Re:Show HN: Auto install npm dependencies as you code by micaksica on Monday August 08, 2016 @02:42PM (#12249943)
Thanks. Reaching out.
[ Parent | on HN ]