This looks interesting, but isn’t this also adding a major security risk for systems that have the…
Martin Spierings
61

Anyone who uses npm is automatically allowing usually-unreviewed arbitrary remote code execution. The npm libraries you install can themselves execute _any_ code. Even if you use --ignore-scripts, you’re still _loading the code_, or the code of some dependency.

This is a known issue not just with npm but with literally any uncurated package manager ecosystem, which includes pretty much all the major language package managers (rubygems/bundler, pypi, cpan, bower, cocoapods, etc).

And no, I don’t believe anyone who claims they go through the effort of individually reviewing every single new dependency for potential malicious code, unless you work at a massive corporation with decades of person-hours to spare.

So that’s the baseline we actually have: by using a package manager you are expressing a certain level of trust in the entire system.

That said, npx can do certain things to mitigate the more glaring issues (things like typosquatting, which is *very* rare in the npm ecosystem based on actual research), but it’s also going to make sure it’s a reasonably useful tool. npm is already working on other mitigations that would improve the situation for both npm and npx (coming soon!), but ultimately, anyone who uses either tool is choosing to put themselves at some level of risk in exchange for convenience.

One clap, two clap, three clap, forty?

By clapping more or less, you can signal to us which stories really stand out.