GitLab discovers widespread NPM supply chain attack

Re:GitLab discovers widespread NPM supply chain attack by seanwilson on Friday November 28, 2025 @08:46AM (#46078596)

Once you run the JavaScript of the npm library you just installed, if it's Node, what's to stop it accessing environment variables and any file it wants, and sending data to any domain it wants?

[ Parent | on HN ]

Re:GitLab discovers widespread NPM supply chain attack by efortis on Friday November 28, 2025 @09:52AM (#46079148)

fs and net can be mitigated with `--permission`

https://nodejs.org/api/permissions.html

Regardless, it’s worth using `--ignore-scripts=true` because that’s the common vector these supply chain attacks target. Consider that when automating the attack, adding it to the application code is more difficult than injecting it into life-cycle scripts, which have well-known config lines.

[ Parent | on HN ]

Re:GitLab discovers widespread NPM supply chain attack by MetaWhirledPeas on Friday November 28, 2025 @08:58AM (#46078692)

Nothing, but at least you'll have time to see the audit if it's aware.

[ Parent | on HN ]