NPM packages from Red Hat have been compromised

Re:NPM packages from Red Hat have been compromised by tremon on Monday June 01, 2026 @11:50AM (#48358497)

To meekly defend the indefensible here: it's not like rmdir on Linux (I won't speak for all Unixen) can cause loss of data, since it only removes empty directories.

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by MattSteelblade on Monday June 01, 2026 @12:11PM (#48358799)

In this case, the rm -rf before that does. The rmdir is the Windows command in this example and with /s /q, it will quietly delete everything.

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by rixed on Monday June 01, 2026 @01:16PM (#48359754)

Yep, but that could still cause issues (those entries could be used as signals, or be mount points for currently unmounted partitions, etc). rmdir anything that start with "/" should be an absolute no-go.

To say nothing about running a sequence of shell commands without the -e option.

[ Parent | on HN ]