[kalcode]

People make this joke often. It's package managers and how loose we are with installing them, not NPM.

Cargo,PyPi,Nuget,PHP has had these recent too.

It's not just only NPM. It's frequently repeated here just cause of the average bias against Node.

But this problem isn't isolated to NPM.

[Defletter]

The problem is compounded with NPM though thanks to lifecycle scripts: yes, any and all package managers create a risk of supply-chain attack, but NPM makes it dangerous to merely open a project up in an IDE.

[dns_snek]

> but NPM makes it dangerous to merely open a project up in an IDE.

It does not. Opening a project in an IDE has always been dangerous because there are about a thousand language server and analysis tools that run in the background. This is why IDEs ask you whether you trust the contents of a repository.

An even if some automated background execution initiated by the IDE doesn't get you, running `npm run test` 15 seconds later will.

[okanat]

It is the same for Crates.io and PyPI they also supply scripts without asking the user so opening an IDE will run them. For PyPI you need to even execute scripts to discover the dependencies!

[kalcode]

That's a good point. For me it's getting people to realize they need to take up practice that help minimize these things. It's kinda us and them problem.

We need to ensure we don't just blindly install the latest, patch every CVE by just bumping everything to the latest even if the vulnerability has nothing to do with their system or use of said library.

We should have rules that we install the latest that's older than three days.

We should be running "npm audit" and other stuff like Trivy.

The three day rule alone could save most people.

[thaumasiotes]

> The three day rule alone could save most people.

The three day 'rule' is just you hoping that someone else does some free work for you. If it is adopted by everyone, it has zero effect.

We need rules that still work if people follow them.

[paulddraper]

Pip, Composer, RubyGems, NuGet, and several others have lifecycle scripts.

As of course do the OS managers -- apt, yum, Homebrew.

[Kuinox]

nuget have targets, and allow to run code on build, it doesn't have this problem because there is less dependencies.

[latexr]

> It's frequently repeated here just cause of the average bias against Node.

It’s frequently repeated here because NPM is where it keeps happening over and over and over and over and over and over again.

[philipwhiuk]

In short, the problem is `npm` not NPM.

[stingraycharles]

How many package managers allow executing arbitrary code as part of the installation process by default?

[icedchai]

Almost all of them.

[stingraycharles]

I haven’t seen this in Go or Java?

[icedchai]

Ok, so you are right, Go and Java (Maven, at least) doesn't have this issue.