undefined | Better HN

0 pointsthemafia17d ago0 comments

Download source. Extract. Move files to correct node_modules folder.

If your distribution requires more than this, then it's not really a module, or combines too many non-modular components, and should be distributed differently.

The ability for npm to run scripts on any level should be removed.

Then we can go back to worrying about namespacing issues.

0 comments

6 comments · 3 top-level

dist-epoch17d ago· 3 in thread

If an attacker can infect the post-install script of an npm package, they can also infect the package source code itself. So if you ever run the project outside the sandbox, you will still get compromised.

It's like saying "I don't trust a software app with an installer, I just want a .zip with the binaries from the same source that I will run myself"

themafiaOP17d ago

> they can also infect the package source code itself

Which is where the concept of "safe levels" come in. I should be able to install this module in such a way where file operations and process operations are not available to it. That being said, presumably, this types of infiltration would seem to be _much_ easier to spot. "Why is this web framework calling 'spawn'?"

> I just want a .zip with the binaries

I want a .zip with the _code_. Just the code. None of the packaging nonsense. My distribution can handle that.

ashishb17d ago

> I should be able to install this module in such a way where file operations and process operations are not available to it.

That's the definition of a sandbox, isn't it?

dist-epoch17d ago

do you really think you will see a clear "spawn" call? there is a long history of obfuscating what the code does to hide backdoors, in quite ingenious ways

> I should be able to install this module in such a way where file operations and process operations are not available to i

technically browser sandboxes, WASM, do this. but then you are very limited since you can only sandbox the whole app, and not one module, so if you need local file access, you need to open it up to the whole app and all it's modules

ashishb17d ago

> The ability for npm to run scripts on any level should be removed.

Even Python has that ability now. Also, `npm run dev` is running the script with full disk access.

Heck, Vscode/Cursor will auto-execute code if you open a project. And this has been actively used in the wild https://ashishb.net/security/contagious-interview/

63stack17d ago

You discovered what web development was like in early 2000.

j / k navigate · click thread line to collapse

0 comments

6 comments · 3 top-level

dist-epoch17d ago· 3 in thread

It's like saying "I don't trust a software app with an installer, I just want a .zip with the binaries from the same source that I will run myself"

themafiaOP17d ago

> they can also infect the package source code itself

> I just want a .zip with the binaries

I want a .zip with the _code_. Just the code. None of the packaging nonsense. My distribution can handle that.

ashishb17d ago

> I should be able to install this module in such a way where file operations and process operations are not available to it.

That's the definition of a sandbox, isn't it?

dist-epoch17d ago

do you really think you will see a clear "spawn" call? there is a long history of obfuscating what the code does to hide backdoors, in quite ingenious ways

> I should be able to install this module in such a way where file operations and process operations are not available to i

ashishb17d ago

> The ability for npm to run scripts on any level should be removed.

Even Python has that ability now. Also, `npm run dev` is running the script with full disk access.

Heck, Vscode/Cursor will auto-execute code if you open a project. And this has been actively used in the wild https://ashishb.net/security/contagious-interview/

63stack17d ago

You discovered what web development was like in early 2000.

j / k navigate · click thread line to collapse