You have no idea how how bad this really is.

When I came to the node world about 8 years ago, I immediately identified post and pre install scripts as a big weakness. It's honestly unbelievable that EVERY npm package can just decide to run whatever. How is this still allowed in npm by default?

This is why you don't update and deploy to _prod_ just before everyone leaves for a long holiday weekend.

It will happen again unless developers see checking random third-party library codes as important as indentation. All unaudited third-party code should be treated as malware unless proven otherwise.

"The PR making this change was merged on the 11th of September". 9/11, the prelude

It's crazy that other package registries didn't get news like this

maybe the webdev world will finally realize that infinite libraries lead to infinite attack vectors?

Theo never watched Dune. shame

That is scary. I wrote a npm.cmd that runs all npm commands in a clean docker container and uninstalled node from my host machine. Yeah, it's slower and I have to map some ports, but at least I am not gonna be pwnt. I basically treat NPM as dangerous by default.

Thanks Theo. This information is extremely valuable. I feel bad for the people whose packages have been exploited.

At this point, you can release a npm hack video once a month