NPM packages from Red Hat have been compromised

Re:NPM packages from Red Hat have been compromised by jmull on Monday June 01, 2026 @11:54AM (#48358551)

> That's an INSANE default.

I agree that not running arbitrary installation scripts is the right default, but it's just an incremental improvement.

The practical difference between code that runs at installation and code that runs when the package is executed is, very typically, a small amount of time.

IMO, the hyperbole here hurts because it distracts from more effective efforts.

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by Someone1234 on Monday June 01, 2026 @12:13PM (#48358824)

> IMO, the hyperbole here hurts because it distracts from more effective efforts.

For example?

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by megous on Monday June 01, 2026 @01:22PM (#48359852)

Can I just run npm update diff and see all changes across all updates compared to the last reviewed code in node_modules? Why not?

[ Parent | on HN ]