Re:Self Propagating NPM Malware Compromises over 40 Packages
by qudat on Tuesday September 16, 2025 @10:21AM
(#45262619)
The blast radius is made far worse by npm having the concept of "postinstall" which allows any package the ability to run a command on the host system after it was installed.
This works for deps of deps as well, so anything in your node_modules has access to this hook.
It's a terrible idea and something that ought to be removed or replaced by something much safer.
Re:Self Propagating NPM Malware Compromises over 40 Packages
by zarzavat on Tuesday September 16, 2025 @10:54AM
(#45263145)
I agree in principle, but child_process is a thing so I don't think it makes much difference. You are pwned either way if the package can ever execute code.
This works for deps of deps as well, so anything in your node_modules has access to this hook.
It's a terrible idea and something that ought to be removed or replaced by something much safer.