News for hackers. Stuff that matters.

A comment on Postmortem: TanStack npm supply-chain compromise. Parent comment

Re:Postmortem: TanStack npm supply-chain compromise by sinsudo on Tuesday May 12, 2026 @04:34AM (#48105702)
Anything that can be modified by an attacker can not be used to secure the sudo command. This is a recursive requirementor hierarchy for secure systems.
[ Parent | on HN ]
Re:Postmortem: TanStack npm supply-chain compromise by eviks on Tuesday May 12, 2026 @05:23AM (#48105990)
You can set the permissions so that the attacker can't modify it?
[ Parent | on HN ]
Re:Postmortem: TanStack npm supply-chain compromise by lrvick on Wednesday May 13, 2026 @08:10AM (#48120879)
You would need to prevent an attacker from installing shell aliases, or shell config files, or altering any binaries in PATH.

Like, sure you could, but you end up with a very useless system.

Easier to just use VMs for each security context.

[ Parent | on HN ]
Re:Postmortem: TanStack npm supply-chain compromise by eviks on Wednesday May 13, 2026 @08:14AM (#48120911)
Is any of this specific to a link vs tyre original full-pathed sudo?
[ Parent | on HN ]