NPM packages from Red Hat have been compromised

Re:NPM packages from Red Hat have been compromised by oblio on Monday June 01, 2026 @11:14AM (#48357947)

A lot of packages are pulled in to call minimal bits of the actual library. I obviously don't have any statistics on this but my instinct would say that for the average application only 5% of an average package is actually used.

So not running package installation scripts is a huge, massive problem.

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by IshKebab on Monday June 01, 2026 @12:27PM (#48359028)

So what? Packages can just put their backdoors in some initialisation code that is always used.

It is possible that not running package installation scripts could improve security, but for that you need really good sandboxing/compartmentalisation of library code, e.g. with CHERI, WASI component model, or if all of your code must run in a secure context it probably helps.

But those situations are unfortunately rare in my experience.

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by dns_snek on Monday June 01, 2026 @02:44PM (#48360935)

It doesn't matter how much of the package you use. Here, you can use literally 0% of Koa and get pwned by one of its transitive dependencies (koa > cookies > keygrip > tsscmp) by simply importing the parent package:

    mkdir demo && cd demo
    npm install --save [email protected]
    echo 'console.log("--- pwned by a transitive dependency ---")' >> node_modules/tsscmp/lib/index.js
    node -e "import 'koa'"

--- pwned by a transitive dependency ---

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by oblio on Tuesday June 02, 2026 @04:19AM (#48367427)

My point was for proper package management tools that don't allow running scripts.

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by IshKebab on Tuesday June 02, 2026 @05:40AM (#48367956)

His example did not involve running any post-install scripts.

[ Parent | on HN ]