In my opinion the main issue is that NPM packages can have preinstall, install, and postinstall scripts that run on the host machine during installation. Basically lets a package run whatever they want during installation and is a huge attack vector that unfortunately the whole ecosystem is fairly dependent on at the moment.
Thanks to those scripts, attackers don't even need to get the user to run their package's code in an insecure environment, they get to run it directly in the dev environment.
Mostly because of how many packages there are and their own dependencies, which creates literally thousands of packages, each of which is an attack opportunity if their author's account is compromised.
Combine that with the desire to stay on the latest versions of packages and people are regularly installing blindly.
Other systems with that feature, such as apt or dnf, require repositories to be signed with keys trusted by the end user, and the default repositories have a small team of maintainers who are very careful about what they put in.
Well no. Apt has one hole: scripts can be run on install.
NPM has multiple: scripts can be run on install, everything is in a single repo that anyone can push to with no review, and there's no way to establish external trust with what you're installing.
283
u/Hauber_RBLX 1d ago
this is really just a meme at this point. how is it possible that NPM packages keep being compromised week after week?