That postinstall and other scripts have been a problem for a long time - the PoC for example could be installed via npx, which would then run postinstall which executes another script to steal /etc/password data.
This is not a new problem, you just have another vector.
I came up with a free linter package to try solve it - but no one seemed interested, and here we are 7 later talking about where people are now offering paid services to mitigate it.
Nice tool, but I don't see how it would detect the issue described in the blog post, which is that the manifest uploaded to npm does not match the manifest inside the tarball. The package.json that's presented to npm is never actually downloaded into your node_modules.
The tool was for the toolchain work 7 years ago, maybe if it had continued I've have worked on a bunch of stuff around dependency checking (which I actually did write recently). Like I said I tried to speak up about it then and was shut down by several npm core people so I just moved on instead of spending the energy.
(Everyone seems so focused on the blog post and missing the fact since NPM was created you've been able to manipulate it's postinstall script to install malware - at any level, including npms failure to verify the manifest file)
Comments
Sorry if I'm misunderstanding, but how is this the same issue discussed in the article?
That postinstall and other scripts have been a problem for a long time - the PoC for example could be installed via npx, which would then run postinstall which executes another script to steal /etc/password data.
This is not a new problem, you just have another vector.
I came up with a free linter package to try solve it - but no one seemed interested, and here we are 7 later talking about where people are now offering paid services to mitigate it.
https://github.com/tanepiper/npm-lint
Nice tool, but I don't see how it would detect the issue described in the blog post, which is that the manifest uploaded to npm does not match the manifest inside the tarball. The package.json that's presented to npm is never actually downloaded into your node_modules.
The tool was for the toolchain work 7 years ago, maybe if it had continued I've have worked on a bunch of stuff around dependency checking (which I actually did write recently). Like I said I tried to speak up about it then and was shut down by several npm core people so I just moved on instead of spending the energy.
(Everyone seems so focused on the blog post and missing the fact since NPM was created you've been able to manipulate it's postinstall script to install malware - at any level, including npms failure to verify the manifest file)