$ sudo rm -rf / === NPM install

Re:$ sudo rm -rf / === NPM install by bin_bash on Tuesday November 09, 2021 @08:16AM (#29161298)

You'll presumably be executing the code which could trivially include `childProcess.spawn()`. I think energy would be better spent vetting the author of the package. If you're concerned, install it in a VM. It's never safe to run code in any language if you think it might be suspect.

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by roblabla on Tuesday November 09, 2021 @08:24AM (#29161380)

The problem is rarely the author going rogue, but rather their accounts getting hacked, and the hacker pushing a malicious update to an existing package. Vetting the author won't really help, you need to vet the updates.

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by bloodyvalentine on Tuesday November 09, 2021 @08:39AM (#29161556)

Vetting the author of the package is neither very realistic in a lot of cases, nor a great solution to this problem unfortunately. A lot of people got impacted by this issue through Karma, which is extremely popular and trusted by the community. In this case, the bad actor also managed to access ua-parser-js author's NPM account and push the bad version directly, so not really the case of an author going rogue.

[ Parent | on HN ]