7 ms·

This vulnerability was reported to NPM in 2016: https://blog.npmjs.org/post/141702881055/package-install-scripts-vulnerability https://blog.npmjs.org/post/14170

This vulnerability was reported to NPM in 2016: https://blog.npmjs.org/post/141702881055/package-install-scripts-vulnerability https://blog.npmjs.org/post/141702881055/package-install-scr... https://www.kb.cert.org/vuls/id/319816 https://www.kb.cert.org/vuls/id/319816 but the NPM response was WAI.

rectang 1y ago
Acronym expansion for those-not-in-the-know (such as me before a web search): WAI might mean "working as intented", or possibly "why?"
- 201984 1y ago
  Thank you. It's frustrating when people uncommon acronyms without explaining them.
  - maxverse 1y ago
    AI is helpful for this, but I also built https://www.hackterms.com https://www.hackterms.com eight years ago for this exact reason.
    - Vinnl 1y ago
      And of course good old Urban Dictionary: https://www.urbandictionary.com/define.php?term=WAI https://www.urbandictionary.com/define.php?term=WAI
debazel 1y ago
Even if we didn't have post install scripts wouldn't the malware just run as soon as you imported the module into your code during the build process, server startup, testing, etc? I can't think of an instance where I ran npm install and didn't run some process shortly after that imported the packages.
- theodorejb 1y ago
  Many people have non-JS backends and only use npm for frontend dependencies. If a postinstall script runs in a dev or build environment it could get access to a lot of things that wouldn't be available when the package is imported in a browser or other production environment.
  - brw 1y ago
    I wonder why npm doesn't block pre/postinstall scripts by default, which pnpm and Bun (and I imagine others) already do. EDIT: oh I scrolled down a bit further and see you said the exact same thing in a top-level comment hahah, my bad
  - mdavidn 1y ago
    Malicious client-side code can still perform any user action, exfiltrate user data via cross-domain requests, and probe the user's local network.
amai 1y ago
NPM belongs to Microsoft. What do you expect?
- myroon5 1y ago
  NPM was acquired 4 years after that post

rectang 1y ago

Acronym expansion for those-not-in-the-know (such as me before a web search): WAI might mean "working as intented", or possibly "why?"

201984 1y ago
Thank you. It's frustrating when people uncommon acronyms without explaining them.
- maxverse 1y ago
  AI is helpful for this, but I also built https://www.hackterms.com https://www.hackterms.com eight years ago for this exact reason.
  - Vinnl 1y ago
    And of course good old Urban Dictionary: https://www.urbandictionary.com/define.php?term=WAI https://www.urbandictionary.com/define.php?term=WAI

debazel 1y ago

Even if we didn't have post install scripts wouldn't the malware just run as soon as you imported the module into your code during the build process, server startup, testing, etc? I can't think of an instance where I ran npm install and didn't run some process shortly after that imported the packages.

theodorejb 1y ago
Many people have non-JS backends and only use npm for frontend dependencies. If a postinstall script runs in a dev or build environment it could get access to a lot of things that wouldn't be available when the package is imported in a browser or other production environment.
- brw 1y ago
  I wonder why npm doesn't block pre/postinstall scripts by default, which pnpm and Bun (and I imagine others) already do. EDIT: oh I scrolled down a bit further and see you said the exact same thing in a top-level comment hahah, my bad
- mdavidn 1y ago
  Malicious client-side code can still perform any user action, exfiltrate user data via cross-domain requests, and probe the user's local network.

amai 1y ago

NPM belongs to Microsoft. What do you expect?

myroon5 1y ago
NPM was acquired 4 years after that post