Is Running Random Code from NPM Safe?

socket.dev

2 pointsfeross2 comments

Now I want to script this. Create a VM, create a project that uses a random package, built it and wait for signs of compromise. Rinse and repeat.

Do it! This sounds fun :)

Reminds me of an idea I had a while back: create a VM running Windows XP (without service packs, and crawl the web downloading and executing every .exe file that is found. Wait and see what happens to the machine.

Reply on news.ycombinator.com