6 ms·
Reading through the post it looks like this infects via preinstall? > The new versions of these packages published to the NPM registry falsely purported to int
by dschofie 10mo ago
Reading through the post it looks like this infects via preinstall?
> The new versions of these packages published to the NPM registry falsely purported to introduce the Bun runtime, adding the script preinstall: node setup_bun.js along with an obfuscated bun_environment.js file.
- twistedpair 10mo agoYou're right. PNPM disables all install scripts by default. I was just noting one example.