Three NPM packages found opening shells on Linux, Windows systems

The terminology in the article is confusing. A shell is a means of supplying instructions to the OS, which when provided a UI becomes a command terminal. Any NPM package that makes use of arbitrary child processes opens a shell. This is clear in Node’s documentation for child processes. Very many NPM packages make use of child processes.

It only becomes a security problem when malicious instructions are passed into that spawned shell or network ports are opened for remote access to a shell. Either way these problems are potentially present in most systems applications and are generally addressed with security policies set in the OS.