What's Going on Inside Your Node_modules Folder?

Re:What's Going on Inside Your Node_modules Folder? by nightski on Tuesday March 01, 2022 @10:10PM (#30523188)

I'd be curious to see how many packages have a pre/post install script that gets executed automatically by npm. This seems particularly problematic. It's a huge reduction in security, I'm surprised npm can justify the feature.

[ Parent | on HN ]

Re:What's Going on Inside Your Node_modules Folder? by bretc on Tuesday March 01, 2022 @11:04PM (#30523530)

Check out http://socket.dev/npm/issue/installScripts

Majority are benign, but when a package without one adds one, you probably want to see why :)

[ Parent | on HN ]

Re:What's Going on Inside Your Node_modules Folder? by photon12 on Tuesday March 01, 2022 @10:16PM (#30523241)

There's a reason I'll only ever run NPM in a VM on any machine that has any data I care about

[ Parent | on HN ]

Re:What's Going on Inside Your Node_modules Folder? by bretc on Tuesday March 01, 2022 @11:08PM (#30523563)

Install scripts can be disabled with a config file, or npm flag, but your paranoia is not unwarranted.

[ Parent | on HN ]

Re:What's Going on Inside Your Node_modules Folder? by mekster on Tuesday March 01, 2022 @11:02PM (#30523514)

Does deno (try to) solve any of this?

[ Parent | on HN ]

Re:What's Going on Inside Your Node_modules Folder? by bretc on Tuesday March 01, 2022 @11:07PM (#30523551)

Deno does not have install scripts, or a lot of other npm+node features. You can turn these off in npm though if you want a hardened install step.

[ Parent | on HN ]