No more JavaScript, it's clear y'all can't be trusted with it.

[cr0w@infosec.exchange]

@darfplatypus Fuckin FINALLY

[huronbikes@cyberplace.social]

@darfplatypus

[nyanbinary@infosec.exchange]

@darfplatypus eyes https://www.aikido.dev/blog/durabletask-package-compromised-mini-shai-hulud don't you dare touch my snek!

[sharkfie@infosec.exchange]

@huronbikes @darfplatypus perfect, no notes

[lil5@social.last.nl]

@huronbikes @darfplatypus The problem lies with npm postinstall, as soon as we all collectively agree to use a package manager that doesn’t run a postinstall script of any dependency you install, this goes away.

Pnpm bun idk.

[huronbikes@cyberplace.social]

@lil5 @darfplatypus *stares in lpad incident from 10 years back from which nothing of value was learned*

[lil5@social.last.nl]

@huronbikes @darfplatypus omfg it’s been that long

npm Blog Archive: Package install scripts vulnerability

npm Blog (Archive); updates from the npm team are now published on the GitHub Blog and the GitHub Changelog

(blog.npmjs.org)

Looks at published date: March 25th, 2016 10:16pm

[huronbikes@cyberplace.social]

@lil5 @darfplatypus

[epic_null@infosec.exchange]

@darfplatypus Yay!!!!

[abt1181@ioc.exchange]

@darfplatypus go screw yourself, AL HAIL SAINT JAVASCRIPT

[secretsloth@mastodon.art]

@darfplatypus (pauses with a spoonful of JavaScript halfway to mouth) (tries to hide the rest of the bowl behind back) it's just lucky charms

[novet@infosec.exchange]

@lil5 @huronbikes @darfplatypus what's great is that afaik you can turn off postinstall on most of these package managers

hell, most even introduced options to set a window where it won't update to the latest package if a release is within the time window.

[tkissing@mastodon.social]

@darfplatypus From my cold dead SSDs

[aanee@mastodon.online]

@darfplatypus

[lil5@social.last.nl]

@novet @huronbikes @darfplatypus

I’ve really enjoyed pnpm and deno they’re both great indeed

[linkplay@biplus.social]

@darfplatypus can you turn ai off while you are at it?

[sleet01@fosstodon.org]

@darfplatypus

[glitchcake@tech.lgbt]

@darfplatypus better be safe and cut the plug off

[jkdelauney@tech.lgbt]

@darfplatypus This is long overdue and I applaud your willingness to take this needful corrective action.

[novet@infosec.exchange]

@lil5 @huronbikes @darfplatypus a group im part of are just starting a migration from bun to deno. am not really involved but it seems like the best option currently.