misc-scripts VS nvm

I use an overdesigned bash script that searches the home directory for files that match a string. The reason for not just searching .local and .config is that some programs make their own dot-directories.

I'm glad to see that I'm not the only person worried about this. It's a pretty glaring bit of attack surface if you ask me. I chuckled when I saw you used nvm as an example in your readme. I've pestered nvm about this sort of thing in the past (https://github.com/nvm-sh/nvm/issues/3349).

I'm a little uncertain about your threat model though. If you've got an SSL-tampering adversary that can serve you a malicious script when you expected the original, don't you think they'd also be sophisticated enough to instead cause the authentic script to subsequently download a malicious payload?

I know that nobody wants to deal with the headaches associated with keeping track of cryptographic hashes for everything you receive over a network (nix is, among other things, a tool for doing this). But I'm afraid it's the only way to actually solve this problem:

1. get remote inputs, check against hashes that were committed to source control

2. make a sandbox that doesn't have internet access

3. do the compute in that sandbox (to ensure it doesn't phone home for a payload which you haven't verified the hash of)

Remember the day you've installed nvm for node and npm?

NVM GitHub Repository

nvm (Node Version Manager): The most popular choice, especially on Linux and macOS. It installs Node.js within your user directory, completely avoiding the need for sudo when installing global packages. It makes switching between different Node.js versions effortless. (GitHub - nvm-sh/nvm). I have used this for years.I used pnpm, you can use npm

Let’s get it running locally first. You should have Node installed (you may also use nvm or docker).

Make sure you have node installed. If not, I recommend installing via nvm(Node Version Manager)

I was welcomed with an error that it couldn’t find npx command, which makes sense - I’m using NVM to manage node.