Feature request: Allowlist for third-party scripts run during installation
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 225
- Forks
- 19
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 3
Description
Problem
Third-party scripts (i.e. scripts from dependencies) run during installation can be used for supply-chain attacks, which have been increasingly common recently.
Feature request
To protect against this risk, Yarn should run no third-party scripts by default. The only code run by default during installation should be from Yarn itself, the project author directly (i.e. top-level install scripts), or foundational system dependencies (e.g. Node.js, Bash, etc.).
Instead of running by default, install scripts from dependencies can be selectively enabled using an allowlist. This allows the project author to accept the risks of install scripts on a case-by-case basis, giving them the opportunity to do whatever analysis/audit/risk assessment they deem necessary. It also protects against new unexpected or unwanted install scripts.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files, tests, or entry points. Start by locating where dependency installation scripts are executed and how install configuration is represented, then compare existing tests and configuration patterns before defining the allowlist behavior and its completion criteria.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nodejs, rust
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100