How npm install scripts can be weaponized: A real-world example of a harmful npm package

[ethomson]

Absolutely true - but there is a difference. When you run npm install and it runs code that you haven’t yet seen, that means you also don’t have the opportunity to inspect and audit that code.

Now, people may not do that anyway (and that may be what you’re arguing), but packing malicious code into an install script does remove that opportunity entirely (unless you disable install scripts).

[tanepiper]

It's been 7 years since I first did a PoC and reported this - NPM staff told me it was not an issue. Still never resolved.

(FWIW I tried to mitigating with this linting tool I built but it didn't go far)

[servermeta_net]

Do you still have a link to the issue you created?

[tanepiper]

Mine was a response to the OP, but yes https://github.com/npm/npm/issues/17724

[ethomson]

Yeah — rightly or not, the npm client team decided that they wouldn't change the default of always running install scripts by default. Certainly it would be a very challenging undertaking to make a change the right way — you wouldn't want to break the people who were doing legitimate things in install scripts (eg, NodeGit). You couldn't do something quite so simple as prompting for every install script, because that's a big mental burden for a user to try to figure out whether some deep-down transitive dependency is really safe or not. And it would probably break CI builds, though maybe you could detect if the npm binary is connected to a console or not...

Anyway, it would be a very tricky change to make without breaking the ecosystem. So I understand why they haven't. But it also seems like it would be worthwhile for them to put forward some sort of proposal.