News for hackers. Stuff that matters.

A comment on Neovim Pack. Parent comment

Re:Neovim Pack by feinte on Thursday September 04, 2025 @02:33AM (#45124237)
A plugin can spawn arbitrary processes so if neovim is not started in a sandbox (container, namespace, firejail...) they can basically do whatever your user has the right to do.

Pretty big supply chain risks here.

[ Parent | on HN ]
Re:Neovim Pack by WhyNotHugo on Thursday September 04, 2025 @04:48AM (#45125108)
And often times sandboxing it is hard.

E.g.: what do you use to edit ~/.ssh/config or ~/.profile?

[ Parent | on HN ]