News for hackers. Stuff that matters.

A comment on Postmortem: TanStack npm supply-chain compromise. Parent comment

Re:Postmortem: TanStack npm supply-chain compromise by lrvick on Tuesday May 12, 2026 @04:45AM (#48105774)
A simple LD_PRELOAD command can cause your shell to run "rm -rf /" when you type "/sudo".

If your unprivileged user is compromised, you are pretty hosed.

[ Parent | on HN ]
Re:Postmortem: TanStack npm supply-chain compromise by anthk on Tuesday May 12, 2026 @06:43AM (#48106411)
It should be a way to make system env vars (profile.d or simlar) as readonly so every users' shell had these set to empty values and unable to change them.
[ Parent | on HN ]
Re:Postmortem: TanStack npm supply-chain compromise by FooBarWidget on Tuesday May 12, 2026 @08:16AM (#48107170)
I have a better idea, not dependent on whether shell is secure (which is endless whack a mole): https://news.ycombinator.com/item?id=48107092
[ Parent | on HN ]
Re:Postmortem: TanStack npm supply-chain compromise by marshray on Tuesday May 12, 2026 @06:54PM (#48115659)
Shell-only, but https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V...
[ Parent | on HN ]
Re:Postmortem: TanStack npm supply-chain compromise by anthk on Wednesday May 13, 2026 @03:32AM (#48118897)
Yes; I'm aware, but for some environments writting a custom shell as the one for SDF would be an easier task. Or maybe a really restricted "ash" called "rash" -because it is- with maybe autocomplete and that's it. Hardcoded $PATH and the like.
[ Parent | on HN ]