Re:ESLint compromised, may have stolen your credentials
by inglor on Thursday July 12, 2018 @12:17PM
(#17516032)
> 3. Warn when the dependency tree goes too deep (8 or 9 levels of deps)
Hmm, why?
> 4. Better auditing of suspicious patterns (accessing .npmrc should throw a flag)
As in - when `.npmrc` is accessed as a result of `npm install` you would want NPM to warn?
Re:ESLint compromised, may have stolen your credentials
by vorpalhex on Thursday July 12, 2018 @12:26PM
(#17516142)
I can't imagine most modules need to read or write your .npmrc directly (npm itself does). That should flag a module (with the understanding that I'm sure there's some modules that do legitimately need that access - eg to easily swap which registry you're publishing too).
When a dependency tree starts going too deep, it's too easy for malicious modules to get snuck in. You pull in Popular Library X which depends on well-known module A, which in turn pulls in shim B, which in turn depends on an unpinned utility C. Somebody sneaks a malicious hook into utility C which isn't used directly by anybody really, but propagates the malicious code to all the users of Popular Library X (eg Babel).
2. Limit network calls without additional permissions
3. Warn when the dependency tree goes too deep (8 or 9 levels of deps)
4. Better auditing of suspicious patterns (accessing .npmrc should throw a flag)