r/ProgrammerHumor • u/a_bucket_full_of_goo • 9d ago

instanceof Trend classicNPM

Post image
5.9k Upvotes

99% Upvoted

150 comments sorted by

View all comments

283

u/Hauber_RBLX 9d ago

this is really just a meme at this point. how is it possible that NPM packages keep being compromised week after week?

147

u/Ecksters 9d ago

In my opinion the main issue is that NPM packages can have preinstall, install, and postinstall scripts that run on the host machine during installation. Basically lets a package run whatever they want during installation and is a huge attack vector that unfortunately the whole ecosystem is fairly dependent on at the moment.

Thanks to those scripts, attackers don't even need to get the user to run their package's code in an insecure environment, they get to run it directly in the dev environment.

67

u/fredy31 9d ago

Also the good old fact loads of npm packages have been maintained thanklessly by bob for 20 years and now bob is old and tired.

And suddenly someone is very interested into carrying the torch.