npm-install-safe

Npm Install Safe is an experiment to attempt to secure npm installs against malicious and/or compromised packages.

At the moment the full source is under 200 LOC and is provides the most basic of defence against "bad" npm installs.

How it works

npm-install-safe Does a regular npm install with the --ignore-scripts flag set. This flag "will cause npm to not execute any scripts defined in the package.json"

Once that's done, npm-install-safe will inspect the installed modules and determine which modules have an install/postinstall script(s). The user is then prompted to select which packages they'd like to allow to run the install/postinstall script(s).

The selection is also saved in an "npm-install-safe" property in package.json to remember the users selection. This is only done when the package is pinned to the registry by the specific version so authors can't pull a switcheroo.

You can whitelist an entire package name if you want to always trust it. If a popular library which you feel comfortable trusting will never be compromised, would make sense to add to this whitelist. To whitelist webpack, add this to the "npm-install-safe" field: "webpack@*"

You can also blacklist a specific package or all version the same way by adding a - to
that array: ["-core-js@*", "[email protected]"].

For convenience and to ease onboarding of this tool, you can also set the NPM_INSTALL_SAFE_ALLOW_ALL variable to blanket allow/whitelist all dependencies in the install step.

The source at the moment is under 200 LoC so please take a look to better understand (and prod) at the inner workings.

Note

This package only has a dependency on inquire for the user input. If that changes down the line, the other dependencies will be included in the readme along with a justification of why it couldn't be helped.

Install

This package should be installed globally with the -g flag:

npm install -g npm-install-safe

Optionally if you wanted to always have protection against bad actors even when using the regular npm install command, you can use the following bash function (add it to your .bashrc/.zshrc/.profile):

npm() {
  if [[ $1 == "i" || $1 == "install" ]]; then
    command npx npm-install-safe "$@"
  else
    command npm "$@"
  fi
}

Contributing

I'm happy to take contributions in any form for this project. There are a couple of items where I probably need it more than others:

I'm not a security expert by any means. I'd be happy for help hardening this package against folks trying to break it and what it's trying to save against. I'm also looking for help on the bash function to be able to get this to shadow the standard npm install command. What I have works for my setup (oh-my-zsh) in my use cases but I'm probably missing so many edge cases and environments/shells.

Always happy for help on documentation as well.