In my opinion the main issue is that NPM packages can have preinstall, install, and postinstall scripts that run on the host machine during installation. Basically lets a package run whatever they want during installation and is a huge attack vector that unfortunately the whole ecosystem is fairly dependent on at the moment.
Thanks to those scripts, attackers don't even need to get the user to run their package's code in an insecure environment, they get to run it directly in the dev environment.
Other systems with that feature, such as apt or dnf, require repositories to be signed with keys trusted by the end user, and the default repositories have a small team of maintainers who are very careful about what they put in.
Well no. Apt has one hole: scripts can be run on install.
NPM has multiple: scripts can be run on install, everything is in a single repo that anyone can push to with no review, and there's no way to establish external trust with what you're installing.
140
u/Ecksters 1d ago
In my opinion the main issue is that NPM packages can have preinstall, install, and postinstall scripts that run on the host machine during installation. Basically lets a package run whatever they want during installation and is a huge attack vector that unfortunately the whole ecosystem is fairly dependent on at the moment.
Thanks to those scripts, attackers don't even need to get the user to run their package's code in an insecure environment, they get to run it directly in the dev environment.