On 12.0 version of the NPM package manager was released, which is included with Node.js and is used for distributing JavaScript modules. The new version notably ceases the default execution of scripts during package installation. This change is intended to complicate attacks through dependency compromise and slow down the spread of worms activated by installation scripts.
To prevent the auto-execution of scripts specified in package.json via preinstall, install, or postinstall parameters, the allowScripts setting defaults to 'off'. Execution of such scripts, as well as the compilation of C/C++ code by the node-gyp utility when a binding.gyp file is present in the package, now occurs only upon explicit user instruction. Additionally, the parameters ‘—allow-git’ and ‘—allow-remote’ now default to 'none', disabling automatic dependency downloads from Git repositories and direct links to tar archive sites.
To organize the execution of installation scripts, use the command ‘npm approve-scripts’, with the package names of trusted packages as arguments, or the ‘—all’ option to grant permission to all packages. For questionable packages, it is recommended to run the command ‘npm approve-scripts —allow-scripts-pending’, which will list the scripts pending execution. After reviewing these scripts, they can be permitted using the command ‘npm approve-scripts’ and added to the whitelist in package.json.
Additionally, the use of access GAT tokens (Granular Access Tokens) configured for performing actions without two-factor authentication (2FA) in the NPM repository has been announced as prohibited. Starting in August, such tokens will not allow operations like creating or deleting tokens, changing profile, password, or email, setting up two-factor authentication, generating recovery codes, changing access rights, and managing collaborators without further manual confirmation of actions.
Jaanuaris 2027 kavatsetakse keelata pakettide otsepüsimine, kasutades 2FA ümbersõitmiseks mõeldud tokeneid. Samas saab pakette avaldada staging-jaos, kus nad viibivad kuni käsitsi puudutamise kinnitamiseni. Pärast käsitsi kinnitamist saavad avaldatud paketid kasutajatele installimiseks kätte.
Automaatseks avaldamiseks soovitatakse kasutada «Usaldusväärsete väljaandjate» mehhanismi, mis põhineb OpenID Connect (OIDC) standardi ja ajaliselt piiratud kehtivusega autentimistokenite kasutamisel, millega vahetatakse välised teenused ja paketikaust operatsiooni kinnitamiseks paketi avaldamiseks traditsiooniliste paroolide või API pidevalt kehtivate juurdepääsutokenite asemel.
Allikas: opennet.ru
