Hacker News Reader

Comment by notpublic | Hacker News Reader

One can protect from these kinds of vulnerabilities by setting ignore-scripts to true as default:

  npm config set ignore-scripts true

  yarn config set ignore-scripts true

https://blog.npmjs.org/post/141702881055/package-install-scr...

View on HN

I tried this but then basic, very popular packages would fail to install properly. I couldn't even run npm start for my projects -- it would fail silently. So I had to revert because I couldn't get any work done.

Was I just doing this wrong?

try npm install --ignore-scripts when first installing

if problem, evaluate if you need to install that component and if look at the script.

yes, and if i need the component then i have to run the scripts...

There is no easy way to do it. Wish yarn/npm had an --allow-scripts flag.

Anyway, this is what you could do. Find out which packages require postinstall scripts and then run it manually:

  $ grep postinstall node_modules/**/package.json
  node_modules/node-sass/package.json:    "postinstall": "node scripts/build.js",
  $ cd node_modules/node-sass/
  $ yarn run postinstall

On the positive side, you get to know more about the dependency that you are trying to add :)

Wish they could simply disable this behavior! Or at least sandbox those scripts like Deno so if post install needs network or disk access, user has to specify a flag when installing

You can also just not use npm!

Reply on news.ycombinator.com