npm-lint VS steal-ur-stuff

That postinstall and other scripts have been a problem for a long time - the PoC for example could be installed via npx, which would then run postinstall which executes another script to steal /etc/password data.

This is not a new problem, you just have another vector.

I came up with a free linter package to try solve it - but no one seemed interested, and here we are 7 later talking about where people are now offering paid services to mitigate it.

https://github.com/tanepiper/npm-lint

Also ended up writing a similar tool but didn't take it much further.

I did try come up with a npm linter but never really completed it.

A while back I wrote a opt-in tool called npl-lint[1] that would allow some CI-level enforcement of rules in package.json although I didn't go too far with it - one thing was to check the scripts section and allow whitelisted apps, or whitelisted sources for dependencies.

It came about because I ended up having a spat with one of the NPM engineers at the time because they launched npx with the ability to run arbitrary gists[2] and this was before 2FA (FWIW you can still absolutely do this with npx).

I wrote a proof of concept[3] that showed you could, inside a package.json add a command to install another package from a gist location, and then use that to steal credentials, bash history, etc.

[1] https://github.com/tanepiper/npm-lint

I actually did a POC 7 years ago about this - https://github.com/tanepiper/steal-ur-stuff

It was reported to npm at the time, but they chose to ignore it - https://github.com/npm/npm/issues/17724

postinstall malware I reported almost 7 years ago with npm - that it can run any arbitrary script locally or remotely.

I should really get around to how I discovered this 6 years ago and still nothing done about it

Whenever something like this comes up I usually have to tap the sign (and the original report)

Ahh this old one - I wrote a similar package a while back as a proof of concept that npx is a bad idea 5 years ago - the developer at npm at the time told me it wasn't a problem.

Please don't do this and never make it an actual dependency.

Not only that it can run arbitrary code contained in a Gist and I showed this 4 years ago https://github.com/tanepiper/steal-ur-stuff

[3] https://github.com/tanepiper/steal-ur-stuff