yeah but they can just put the dropper, etc in index.js, so that it runs at import time rather than at install time, no? i guess first-install time is often a privileged developer machine, and will execute in a "server"-like runtime such as Node, Bun, Deno. but blocking preinstall scripts is basic first aid...

▲

insanitybit 13 minutes ago | parent | next [-]

Prod tends to have less privileges than CI/CD. CI/CD tends to be full admin, so it's far more sensitive. Prod tends to have tooling for detecting breaches, better logging, etc. People tend to use containers, which act as a sandbox.

Prod also won't be wormable the way that CI/CD is. With CI/CD I can own another dev, use their creds to push another malicious build script, etc. "Attacker is in my prod env" isn't wormable.

Yes, capabilities in prod would be hugely beneficial but removing CI/CD is massive as a win.

▲

JustSkyfall 2 minutes ago | parent [-]

Wouldn't the dropper get executed once tests are run within CI though?

	▲	jitl a minute ago \| parent [-]
		yeah, or when a dev starts the local development server (unless that server is containerized).

▲

jerf an hour ago | parent | prev | next [-]

Nobody is claiming this is a complete solution to security. I would call this "necessary but not sufficient". You won't get far as an engineer if you refuse to implement "necessary but not sufficient" changes because the change doesn't in and of itself one-shot the entire problem.

▲

rcxdude 36 minutes ago | parent [-]

The fact that it's not sufficient also largely means it's not necessary either, because the real solution is auditing and trusting the codebase as a whole. All you do when disabling install hooks is make a lot of situations much more difficult to handle.

▲

jitl 27 minutes ago | parent [-]

"make no mistakes" is not the "real solution"

	▲	rcxdude 22 minutes ago \| parent [-]
		Neither is 'close the gate with no fence on either side of it'. If you want to run code, you either need to run it in a sandbox or trust it. Choosing to run only part of the code is not really a solution. (if you want to disable such hooks yourself, then you may get some security by diversity because you're not using the common configuration. But if it becomes the default then these worms will switch to a different vector)

▲

sysguest 24 minutes ago | parent | prev [-]

well Deno has the necessary ingredients for defense: file-system permission by path