I can approve this from our findings (author of this research): our system lists around 100 instances of the pattern you've mentioned every week, and around %3 are malicious. It would be great seeing it coming to an end.

Yeah. Security aware people have complained about this pattern forever, but then places like macOS Homebrew (brew.sh) just knowingly do it anyway. :(

Unfortunately `npm i` has the same power.

`go get` is the only common dependency downloader I am currently aware of where hostile code doesn't run at install or build time.

I think we need better tooling for working in sandboxes, to at least compartmentalize the explosion. ChromeOS's "virtual machines can open Wayland windows on the main desktop" trick is neat, but the code needed to do that was less than clean or reusable when I last looked.

> `go get` is the only common dependency downloader I am currently aware of where hostile code doesn't run at install or build time.

Maven is the same way, AFAIK.

What's the point? You're going to ship that code to your users, or run it against your production database. If you think it might be malicious, protecting the dev laptop shouldn't be the priority.

I run production services that don't even talk to a database, or that have minimal read-only access. And even for the ones with a lot of write access, having the database stolen/nuked (to be restored from backup) is quite different from handing over all of my browser cookies, or my gcloud/aws/k8s ambient authority credentials that are just sitting in a file (seriously, why is big cloud client security worse than SSH).

Fair enough, some organizations might have devs with limited access, but you're right I can see a lot of situations where the dev laptop has strictly larger blast area.

It’s 0% worse than “add and trust our repository for your distro”, or “download this .deb/.rpm/installer”, or (worst of all) “do one of the above, but trusting a 3rd party who packaged this program for you, rather than the publisher”, which are the realistic alternatives.

Pro tip: use example.com for such examples, because it's reserved specifically for that: https://www.rfc-editor.org/rfc/rfc2606.html#section-3.

Good point, I just totally forgot. :)