Opt in

Hi 👋 I happened on this just meandering around the Node GH. I think this would be an excellent thing to provide with Node, but I’m concerned about some of what’s proposed.

Background

Based on my reading of README/issues clarifying progress, the current behavior is:

1. Install corepack
2. Use Yarn/PNPM commands as if the package manager is already installed in $PATH
3. If it’s not, corepath silently installs and executes it with the command entered

My understanding is that this will be be bundled with Node, eliminating step 1. While convenient, that makes the following steps troubling.

Risks

Users are executing code they didn’t take any affirmative steps to install. This is a clear security issue, but it’s (subtly) more too.

In terms of security risk, it’s similar to npx prior to NPM 7:

• It obfuscates what action the user is actually performing
• It executes network-delivered code without auditability
• It puts the user at the mercy of security decisions made by others
• Network delivered code can be poisoned in a variety of ways, including network API vulnerabilities, hijacked domains, malicious detection of curl … | …

The subtly more bit: false negatives. Users or orgs might have a policy of aliasing these package manager commands to harden or restrict them for their own usage. If an environment isn’t properly provisioned, this would undo those restrictions rather than failing as expected.

Solutions/prior art

NPM 7, thankfully, introduces a prompt when using npx to ask if the user wants to download and execute commands that aren’t already available on $PATH. This isn’t a panacea, but it’s a meaningful improvement over silently downloading and executing third party code.

The same technique could be used here. The downside is it’s a minor inconvenience, but the risks it would help to alleviate are huge.

Considerations

• Automations aren’t interactive, and may expect to be able to bypass this
• Meaningful thought should be put into mitigation of risk around that

The issue points to the README and related issues for the current Corepack behavior; begin there and review how package-manager commands handle tools missing from PATH. Define an opt-in or prompt-based behavior that accounts for non-interactive automation, then verify it against the security and PATH concerns described here.