Twitter Feed
@zkat__ ("kat marchán") replied to a tweet by @zkat__:
just to clarify because apparently some people didn't get it:
"require('package-i-just-installed')" is arbitrary code execution.
postinstall scripts are irrelevant in the face of an unsandboxed nodejs.
require('pkg') is what people are *actually* exploiting in the wild.