News for hackers. Stuff that matters.

A comment on How to build an NPM worm. Parent comment

Re:How to build an NPM worm by PeCaN on Friday July 13, 2018 @12:58AM (#17520619) 

    /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
Ignoring the obvious stupidity here, why does it invoke Ruby only to invoke curl?
[ Parent | on HN ]
Re:How to build an NPM worm by acobster on Friday July 13, 2018 @01:05AM (#17520644)
That's not what it's doing. It's downloading Ruby code and then running it. The "$(...)" is evaluated first.
[ Parent | on HN ]
Re:How to build an NPM worm by tolmasky on Friday July 13, 2018 @12:59AM (#17520624)
It curls the install script, which is passed to ruby as a string which is run.
[ Parent | on HN ]
Re:How to build an NPM worm by PeCaN on Friday July 13, 2018 @01:01AM (#17520630)
Ah, duh, you're right. I forgot $() is bash syntax and not the Ruby syntax for running an external command. Thanks, and yikes.
[ Parent | on HN ]
Re:How to build an NPM worm by analogmemory on Friday July 13, 2018 @01:02AM (#17520636)
Because the install script is in ruby?
[ Parent | on HN ]