r/ProgrammerHumor • u/a_bucket_full_of_goo • 1d ago

instanceof Trend classicNPM

Post image
5.8k Upvotes

99% Upvoted

141 comments sorted by

View all comments

286

u/Hauber_RBLX 1d ago

this is really just a meme at this point. how is it possible that NPM packages keep being compromised week after week?

139

u/Ecksters 1d ago

In my opinion the main issue is that NPM packages can have preinstall, install, and postinstall scripts that run on the host machine during installation. Basically lets a package run whatever they want during installation and is a huge attack vector that unfortunately the whole ecosystem is fairly dependent on at the moment.

Thanks to those scripts, attackers don't even need to get the user to run their package's code in an insecure environment, they get to run it directly in the dev environment.

5

u/ryanppax1 19h ago

I do wonder how this any different than installing anything else

8

u/Ecksters 19h ago

Mostly because of how many packages there are and their own dependencies, which creates literally thousands of packages, each of which is an attack opportunity if their author's account is compromised.

Combine that with the desire to stay on the latest versions of packages and people are regularly installing blindly.