[raesene5]

This is a problem with most/all lib installers. They tend to have hooks to allow post-install actions and those hooks tend to be able to run OS commands, with the privileges of the installing user.

Of course what's extra worrying is it's not just the libs you directly install, but all their dependencies which get to carry out these actions. So for example when you install rails, it will install quite a large number of subsidiary gems.

Then when you add in the fact that the credentials that control dev access to push to places like rubygems and npm are just static username/password combos (which sometimes get stored in plain text in a dot file in the developers home dir) and that there's no common use of digital signing for issued libs (in some cases the installers don't even support it).

[tete]

Well, even if it wasn't a post/pre install, even a node library can fork that exact command, upload your home directory, etc.

That's actually the reason it isn't just dangerous if run as root. Many people have huge amounts of sensitive information and data with read and write access.

A library could of course also fetch even more data. One could create an npm based botnet.