<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<meta content="text/html; charset=UTF-8">
<style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif">
<p>> <span>How would any of that help in practice?</span></p>
<p><br>
</p>
<p>It's just a hardening measure against the particular attack (attempt) described in the original message.</p>
<p>I fully agree it does not prevent such attacks in general.</p>
<p><br>
</p>
<p>Regards,</p>
<p>Eric</p>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com><br>
<b>Sent:</b> Friday, June 12, 2026 3:08:43 PM<br>
<b>To:</b> General discussions about reproducible builds<br>
<b>Cc:</b> Eric Cornelissen<br>
<b>Subject:</b> Re: npmjs.com and preinstall ELF executables</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">On Fri, Jun 12, 2026 at 12:45:00PM +0000, Eric Cornelissen via rb-general wrote:<br>
> Hi,<br>
> <br>
> <br>
> While waiting for npm v12 you can instruct npm to ignore such script by setting `ignore-scripts=true` in `~/.npmrc`.<br>
> <br>
> <br>
> However, both for what I and Marc said, there's a catch: the following bypasses any protections in place<br>
> <br>
> <br>
> ```<br>
> post_install() {{<br>
> cd /tmp<br>
> npm install --ignore-scripts=false REDACTED yargs<br>
> }}<br>
> ```<br>
> <br>
> <br>
> I wrote up <a href="https://github.com/npm/rfcs/issues/896">https://github.com/npm/rfcs/issues/896</a> regarding this, please consider adding a +1 or giving feedback.<br>
<br>
How would any of that help in practice? If attacker can run arbitrary<br>
command already, they can simply override the user configuration (for<br>
example by setting alternative $HOME for the command). And even if<br>
pre/post install scripts functionality would be completely removed from<br>
npm, it still helps only a little, because attacker can simply call the<br>
just installed package in the next command. Sure, it may look a little<br>
more suspicious, but only a little, for example:<br>
<br>
```<br>
post_install() {{<br>
cd /tmp<br>
npm install REDACTED yargs<br>
REDACTED-tool generate-index<br>
}}<br>
```<br>
<br>
IMO more effective would be preventing post-install scripts at the<br>
earlier level - AUR package. But that's probably much less realistic<br>
thing, as AFAIK those are quite common for legitimate purposes... Or<br>
maybe at least run them (and the package build itself too) in a<br>
network-isolated environment (network namespace? systemd-nspawn?). This<br>
would force such malicious packages to rely on files already included in<br>
the package, hopefully making detection significantly simpler.<br>
<br>
-- <br>
Best Regards,<br>
Marek Marczykowski-Górecki<br>
Invisible Things Lab<br>
</div>
</span></font>
</body>
</html>