npm i ... not long after
pass my-password allows a malicious package to steal my entire password store.
pass as a password manager, on Linux. And like probably all Linux users, I use
sudo to run commands as root.
The first time I retrieve a password with
pass my-password, I need to type the passphrase of my GPG private key. Then, the GPG agent will keep this passphrase in memory for a few minutes.
sudo: running a few consecutive
sudo commands will only ask for the password once.
Now, when I install packages with
npm install ... (or with Pip, or any other package manager), these packages can contain scripts that can be run.
This poses an incredibly dangerous security issue: if I run
npm install ... not long after I ran
pass, a malicious package could steal the entire content of my password store. Same issue with sudo. Even more incredible: it's very hard to find people on the interned who care about it.
The first solution that comes to my mind is to set the timeout for the GPG agent and sudo to
Another one is to open every projects I work on in a development container (a docker container), to prevent scripts in it to access my home folder. But it would require to constantly create containers for new and existing projects, which can take quite some time.
Can you think of any other solution?