Embedded malware in RC (NPM package)

Re:Embedded malware in RC (NPM package) by schemescape on Friday November 05, 2021 @07:24PM (#29125801)

That breaks “npm run” (violating the second part of my request).

[ Parent | on HN ]

Re:Embedded malware in RC (NPM package) by jffry on Friday November 05, 2021 @07:32PM (#29125852)

The manpage says that directly invoking a script from package.json with `npm run X` aka `npm run-script X` will still work with this preference set to true, but that it will not run pre/post scripts. Perhaps that is good enough for your use-case?

  npm help run-script
  
   [...]
   ignore-scripts
       o Default: false
       o Type: Boolean
       If true, npm does not run scripts specified in package.json files.

       Note  that  commands  explicitly  intended to run a particular script, such as npm
       start, npm stop, npm restart, npm test, and npm run-script will  still  run  their
       intended  script  if  ignore-scripts  is  set,  but  they will not run any pre- or
       post-scripts.

[ Parent | on HN ]

Re:Embedded malware in RC (NPM package) by schemescape on Friday November 05, 2021 @11:54PM (#29127379)

Edit: That doesn't work as described on NPM 6.14.14 (the version I had), but it does work on NPM 8.1.0 (the version I just upgraded to). Thanks!

[ Parent | on HN ]

Re:Embedded malware in RC (NPM package) by jffry on Saturday November 06, 2021 @08:53AM (#29129810)

Ah, looks like it was introduced in v7.0 - https://github.com/npm/rfcs/pull/185

[ Parent | on HN ]