Embedded malware in RC (NPM package)

Re:Embedded malware in RC (NPM package) by schemescape on Friday November 05, 2021 @03:21PM (#29123660)

I agree that it is an unending arms race, but if NPM doesn't even plug obvious holes (like running install scripts by default), then they've lost my trust.

Edit: if anyone knows of a way to disable NPM from running install scripts automatically (without having to remember to specify --ignore-scripts on each invocation), while still allowing me to use "npm run" to manually run scripts (e.g. test scripts for my own packages), I'd love to hear about it.

[ Parent | on HN ]

Re:Embedded malware in RC (NPM package) by Ginden on Friday November 05, 2021 @04:09PM (#29124196)

npm ci --ignore-scripts

[ Parent | on HN ]

Re:Embedded malware in RC (NPM package) by schemescape on Friday November 05, 2021 @04:41PM (#29124512)

Ah, sorry, I meant a way to automatically do that (both so I don't have to type as much and so that I can't accidentally forget to add that argument). Edited my comment to reflect this.

[ Parent | on HN ]

Re:Embedded malware in RC (NPM package) by jffry on Friday November 05, 2021 @05:36PM (#29124975)

You can run this

  npm config set ignore-scripts true

which will update ~/.npmrc (you can also create project-specific .npmrc files if you prefer)

You can see how NPM has been configured by running

  npm config list

[ Parent | on HN ]

Re:Embedded malware in RC (NPM package) by schemescape on Friday November 05, 2021 @07:24PM (#29125801)

That breaks “npm run” (violating the second part of my request).

[ Parent | on HN ]

Re:Embedded malware in RC (NPM package) by jffry on Friday November 05, 2021 @07:32PM (#29125852)

The manpage says that directly invoking a script from package.json with `npm run X` aka `npm run-script X` will still work with this preference set to true, but that it will not run pre/post scripts. Perhaps that is good enough for your use-case?

  npm help run-script
  
   [...]
   ignore-scripts
       o Default: false
       o Type: Boolean
       If true, npm does not run scripts specified in package.json files.

       Note  that  commands  explicitly  intended to run a particular script, such as npm
       start, npm stop, npm restart, npm test, and npm run-script will  still  run  their
       intended  script  if  ignore-scripts  is  set,  but  they will not run any pre- or
       post-scripts.

[ Parent | on HN ]

Re:Embedded malware in RC (NPM package) by schemescape on Friday November 05, 2021 @11:54PM (#29127379)

Edit: That doesn't work as described on NPM 6.14.14 (the version I had), but it does work on NPM 8.1.0 (the version I just upgraded to). Thanks!

[ Parent | on HN ]

Re:Embedded malware in RC (NPM package) by jffry on Saturday November 06, 2021 @08:53AM (#29129810)

Ah, looks like it was introduced in v7.0 - https://github.com/npm/rfcs/pull/185

[ Parent | on HN ]