npm-lint
actual-malware
npm-lint | actual-malware | |
---|---|---|
4 | 6 | |
26 | 219 | |
- | - | |
0.0 | 0.0 | |
about 4 years ago | about 2 years ago | |
TypeScript | TypeScript | |
MIT License | - |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
npm-lint
-
JavaScript registry NPM vulnerable to 'manifest confusion' abuse
That postinstall and other scripts have been a problem for a long time - the PoC for example could be installed via npx, which would then run postinstall which executes another script to steal /etc/password data.
This is not a new problem, you just have another vector.
I came up with a free linter package to try solve it - but no one seemed interested, and here we are 7 later talking about where people are now offering paid services to mitigate it.
https://github.com/tanepiper/npm-lint
-
Dissecting Npm Malware: Five Packages And Their Evil Install Scripts
Also ended up writing a similar tool but didn't take it much further.
-
npm package to upload your private ssh keys to a pastebin
I did try come up with a npm linter but never really completed it.
-
Getting rid of NPM scripts
A while back I wrote a opt-in tool called npl-lint[1] that would allow some CI-level enforcement of rules in package.json although I didn't go too far with it - one thing was to check the scripts section and allow whitelisted apps, or whitelisted sources for dependencies.
It came about because I ended up having a spat with one of the NPM engineers at the time because they launched npx with the ability to run arbitrary gists[2] and this was before 2FA (FWIW you can still absolutely do this with npx).
I wrote a proof of concept[3] that showed you could, inside a package.json add a command to install another package from a gist location, and then use that to steal credentials, bash history, etc.
[1] https://github.com/tanepiper/npm-lint
actual-malware
What are some alternatives?
ultra-runner - 🏃⛰ Ultra fast monorepo script runner and build tool
harden-runner - Network egress filtering and runtime security for GitHub-hosted and self-hosted runners
pnpm - Fast, disk space efficient package manager
JSPrismarine - Dedicated Minecraft Bedrock Edition server written in TypeScript.
steal-ur-stuff - Steal Ur Stuff
mailgo - 💌 mailgo, a new concept of mailto and tel links [deprecated]
cli - React Native command line tools
reactn - React, but with built-in global state management.