steal-ur-stuff VS project

I actually did a POC 7 years ago about this - https://github.com/tanepiper/steal-ur-stuff

It was reported to npm at the time, but they chose to ignore it - https://github.com/npm/npm/issues/17724

postinstall malware I reported almost 7 years ago with npm - that it can run any arbitrary script locally or remotely.

I should really get around to how I discovered this 6 years ago and still nothing done about it

Whenever something like this comes up I usually have to tap the sign (and the original report)

Ahh this old one - I wrote a similar package a while back as a proof of concept that npx is a bad idea 5 years ago - the developer at npm at the time told me it wasn't a problem.

Please don't do this and never make it an actual dependency.

Not only that it can run arbitrary code contained in a Gist and I showed this 4 years ago https://github.com/tanepiper/steal-ur-stuff

[3] https://github.com/tanepiper/steal-ur-stuff

git clone https://github.com/example/project.git

foo = "0.1" git_foo = { git = "https://github.com/example/project", package = "foo" } custom_foo = { version = "0.1", registry = "custom", package = "foo" }