Malicious code in the purescript NPM installer

Re:Malicious code in the purescript NPM installer by kkapelon on Monday July 29, 2019 @06:07PM (#20559975)

4) You work for a Linux distribution. You have several global npm modules already installed that are safe and secure. You download source code of a killer app in order to package it. You check the source code itself and it is safe. However you didn't realize that there was a local node_modules directory in the git repo that contains package foo-1.2.3 with replaced code that does bad things. That package overrides your global one. You ship a compromised app.

The above scenario is impossible with maven, because there is no concept of local modules. Only the "global" ones will be used when you package an app. So if you check just the source code and it is safe then everything is fine.

[ Parent | on HN ]

Re:Malicious code in the purescript NPM installer by akamaozu on Tuesday July 30, 2019 @01:44AM (#20562383)

Sounds like your argument boils down to "check the source carefully", not "local modules are evil".

If the source was checked carefully, you'd notice a checked-in node_modules dir.

If you didn't check the source properly, you could install a module that seems like it'ss using a known package, but really is using its own malicious version of the global package.

[ Parent | on HN ]