Posted by j12y 15 hours ago
With the new generation of yolo NPM scripters, they simply don't evaluate the risks. They will even fight back telling you that it's the way of doing things.
In reality, it's the warning we learnt back then, that's the result of be mindlessly importing third dependencies without thinking.
In other words, the risks were always there, the new "modern way", let's put it that way, doesn't put the effort anymore.
> that's the result of be mindlessly importing third dependencies without thinking
This is why I have been building, for my own usecases, a new language + compiler + vm that is completely source based. The compiler does not understand linking. You must vendor every single dependency you use, including the standard library, so that it makes its way into the bytecode. The register VM itself is a few thousand lines of freestanding C. Any competent programmer can audit it over a weekend.
v1 deliberately keeps FFI (outside of a bounded set of linux syscalls) outside the current spec as libc has the habit of infecting everything it touches and I want to keep Vm0 freestanding. The last time I compiled the VM, it produced a 70KB binary and supported a loader with structural verification, the entire instruction set using a threaded interpreter, a simple Cheney+MS GC, concurrency via an Erlang-style M:N scheduler working on a single thread, and 20-odd marshaled functions.
Most software in the world does not need anything more than this. Everyone acts as if they are building the next Google.
Think twice before looking at a package and most importantly, always pin your dependencies.
You would have to publish the infected package first to infect others who haven't pinned their dependencies. With a simple pip install -U, and if the dependency is not pinned, then they will get the vulnerable version.
router_runtime.js
SHA256 5f5852b5f604369945118937b058e49064612ac69826e0adadca39a357dfb5b1
SHA1 f1b3e7b3eec3294c4d6b5f87854a52471f03997f
MD5 40d0f21b64ec8fb3a7a1959897252e09Do folk not understand that by doing so, you're enabling modules to maliciously write themselves in to your code?