Re:Understand filesystem takeover vulnerabilities in NPM Jav...
by inimino on Wednesday January 08, 2020 @09:18AM
(#21991626)
"bin": { "/usr/bin/date": "./fake-date" }
The only way that can do anything scary, is if you are running `sudo npm install -g <untrusted package>`, and at that point you should already be terrified. Don't do that.
This is no different from any other package you install from any third party. The author of the package is the relevant third party here, npm is just a host, they don't do your security homework for you. (Think "github", not "Debian".)
The only way that can do anything scary, is if you are running `sudo npm install -g <untrusted package>`, and at that point you should already be terrified. Don't do that.
This is no different from any other package you install from any third party. The author of the package is the relevant third party here, npm is just a host, they don't do your security homework for you. (Think "github", not "Debian".)