News for hackers. Stuff that matters.

A comment on Zed Editor automatically downloads binaries and NPM packages without consent. Parent comment

Re:Zed Editor automatically downloads binaries and NPM packa... by andyferris on Monday July 08, 2024 @06:17AM (#40904123)
NodeJS isn't very sandboxed. Many "dev libraries" are native and will either download and link to binary blobs, or build e.g. C code, which AFAICT is what all the various install scripts are for.
[ Parent | on HN ]
Re:Zed Editor automatically downloads binaries and NPM packa... by broeng on Monday July 08, 2024 @08:48AM (#40904939)
It seems like a bad design choice, that, besides allowing for running untrusted code directly at download time, also makes it difficult to properly mirror artifacts, and I'd assume, make platform portability inconsistent, at best.
[ Parent | on HN ]