Node.js malware caught posting IPs, username, and device info on GitHub

[Macha]

I find this concerning in the context of the tendency for packages to promote the use of npx commands, where npx will just find and run the missing package name, so a typo means you have now just run different code than that what you intend in one command.

[mumblerino]

By default, “npm install” also has the ability to run code after the installation, so npx is not any less safe.

[dave_aiello]

Does the npm Security Policy discussed at https://www.npmjs.com/policies/security govern testing of all NodeJS modules that are available via npm, or does this policy relate to the software that provides the operational infrastructure for npm itself?

[Macha]

Seems very clear to me that this relates to the npm client and backend services.