tailwindcssss
v1.11.0
Published
a demo of NPM vulnerability
Readme
NPM ASE
Arbitrary Script Execution with the Node Package Manager.
Description
This project implements an NPM package published under the sik-asn user called tailwindcssss. The package is an example of how NPM allows for ASE by a package-author on any bash-compatible laptop that installs the module.
cat ~/.bashrc # => prints file-contentsnpm install tailwindcsssscat ~/.bashrc # => "meow"
cat # => "meow"You can undo the changes from installing the package by removing the appended lines inside ~/.bashrc.
