News for hackers. Stuff that matters.

A comment on How to gain code execution on hundreds of millions of people and popular apps. Parent comment

Re:How to gain code execution on hundreds of millions of peo... by areyourllySorry on Friday February 28, 2025 @06:49PM (#43213489)
you can always limit said network access to npm.
[ Parent | on HN ]
Re:How to gain code execution on hundreds of millions of peo... by TheDong on Friday February 28, 2025 @09:05PM (#43214818)
You can't since a large number of npm post-install scripts also make random arbitrary network calls.

This includes things like downloading and compiling pre-compiled binaries for the native architecture hosted on random servers.

npm is really cool.

[ Parent | on HN ]
Re:How to gain code execution on hundreds of millions of peo... by cdmyrm on Saturday March 01, 2025 @03:44AM (#43217359)
npm is a nightmare.
[ Parent | on HN ]