News for hackers. Stuff that matters.

A comment on Understand filesystem takeover vulnerabilities in NPM JavaScript package manager. Parent comment

Re:Understand filesystem takeover vulnerabilities in NPM Jav... by latchkey on Wednesday January 08, 2020 @12:32AM (#21988637)
I personally don't ever install globally either. But I do have './node_modules/.bin' in my PATH because well... I'm lazy.

If two packages try to install the same filename in that directory, I would want a full stop failure so that I can work it out myself. I'm honestly a bit surprised this isn't already the case.

[ Parent | on HN ]
Re:Understand filesystem takeover vulnerabilities in NPM Jav... by ergothus on Wednesday January 08, 2020 @12:46AM (#21988691)
I did that in the past, but now I can run "npx WHATEVER"

The only problem is that npx ALSO defaults to installing things, which is ridiculous.

[ Parent | on HN ]