5 ms·
The archaic model where every tool gets full access to your home directory was never designed for the scenario where a single npm install will install and execu
by ashishb 2mo ago
The archaic model where every tool gets full access to your home directory was never designed for the scenario where a single npm install will install and execute 100s of packages written by various authors.
One should sandbox all npm command executions.
https://github.com/ashishb/amazing-sandbox https://github.com/ashishb/amazing-sandbox
- cpburns2009 2mo agoThis is what I'm transitioning to. All third-party code runs in isolated containers: node/npm, python/pip.
- trucks-refinish 2mo agoYes I highly suggest working in a container or setting up selinux. Selinux is especially powerful for this kind of thing but also requires a lot of advanced knowledge and skills to setup and maintain sadly.
- outloudvi 2mo agoI also believe sandboxing will get more and more important. There might be some trade-off on user experience or convenience, but given the security enhancement and (LLM agent's) freedom I think it will be well worth it.
- anthk 2mo agoSwitch to another user, idealy called 'npm'. su -l npm Then, just in case, run it under bubblewrap so it just can use $HOME and nothing more.
- deleted 2mo ago[deleted]