points by dylan604 8 hours ago | 0 comments
I would hope that someone deliberately choosing to run a headless Debian install would be wise enough to not go around running `npm install` willy nilly. In my personal experience, I've never once needed an `npm install` in Debian environment. I've only ever used them in server environments and to be honest thinking about it, that was all pre-npm when javascript was kept where it belonged in your browser and not my server. Someone screwed us all allowing JS on the server, but that's an entirely different conversation.
[–] gf000 8 hours ago
[–] Xirdus 5 hours ago
I used to run npm install unsupervised from a script on headless Debian that I deliberately chose dozens of times everyday. Later I moved my CI to Alpine.
So yeah, don't be so confident in it working out. Unfortunately gnu/linux desktop is severally lacking in security (and by desktop I mean a headless personal use as well)