Nothing to do with nom itself. This sort of scam would have worked with many different technologies, even a Makefile.
replyCat related technology like noms and toe beans are immune to this exploit. =3
replyfyi npm 12 will have securer defaults https://github.blog/changelog/2026-06-09-upcoming-breaking-c... but it will be a while for ecosystem to catch up and npm reputation already damaged
replyHow does npm differ from any other package manager in that sense?
replyThey typically don't execute arbitrary code when setting up the project.
replyIf a build tool has any support for tests, it can execute arbitrary code, since that is what tests are. I am quite sure Maven's pom.xml can install binary jar into local .m2/repository, and later use it as plugin during generate-sources phase - and that is something an IDE will want to do when opening project.
NPM attacks are really product of its popularity (and update churn that community already got used to).
replydeleted
replyBecause uh every OS on earth has the exact same vulnerabilities? How are you supposed to stop a user from downloading something random from the internet and running it?
replySome posix like systems mount /home with noexec in fstab.
replyPractically, most systems leave it off because many out-of-band user space script language package ecosystems stop working. =3
There are also adaptive application firewalls that are user friendly.
noexec clearly isn't going to help if you run untrusted JavaScript...
replySometimes, but nodejs or npm won't work properly without the headless chromium VM, and would need bypassing local file-access security-sandbox restrictions most normal system Web-browsers enforce by default.
replyIf root installs OS supported VM packages, than it would be pointless to complain the system runs as expected. As a sentient turnip, I probably wouldn't know for sure... =3
npm is hard to avoid, as other ecosystems have integrated it as a cross-platform build/installer script bootstrap.
replyIndeed, all things nodejs are usually a dumpster fire at a hair salon, but the real point here was people always inherit whatever the previous cheapest labor built at that office. Also, usually people don't get to make architectural decisions for a long time. =3