是否可以使用`npm install`运行任何计算机命令?

时间:2018-01-02 08:11:21

标签: node.js npm npm-install npm-scripts

注意到安装bcrypt会运行几个命令,如CMake。我想知道是否可以运行:

  • 文件管理命令(复制,创建,删除)
  • 其他NPM命令(安装,更新,发布等)
  • 潜在恶意代码(form,系统关闭等)

运行public class SongsTab extends Fragment { private ArrayList<songInfo> _songs = new ArrayList<>(); ; RecyclerView recyclerView; SeekBar seekBar; songAdapter songAdapter1; MediaPlayer mediaPlayer; private Handler myHandler = new Handler(); Cursor cursor; @Override public View onCreateView(LayoutInflater inflater, ViewGroup container, Bundle savedInstanceState) { View v = inflater.inflate(R.layout.songs, container, false); recyclerView = v.findViewById(R.id.recyclerView); seekBar = v.findViewById(R.id.seekBar); songAdapter1 = new songAdapter(_songs, getContext()); LinearLayoutManager linearLayoutManager = new LinearLayoutManager(getActivity()); DividerItemDecoration dividerItemDecoration = new DividerItemDecoration(recyclerView.getContext(), linearLayoutManager.getOrientation()); recyclerView.setLayoutManager(linearLayoutManager); recyclerView.addItemDecoration(dividerItemDecoration); recyclerView.setAdapter(songAdapter1); songAdapter1.setOnitemClickListener(new songAdapter.OnitemClickListener() { @Override public void onItemclick(songAdapter.ViewHolder holder, View v, songInfo obj, int position) { System.gc(); int songPath = cursor.getColumnIndex(MediaStore.Audio.Media.DATA); cursor.moveToPosition(position); final String filename = cursor.getString(songPath); if (mediaPlayer.isPlaying()) { mediaPlayer.stop(); mediaPlayer.reset(); mediaPlayer.release(); mediaPlayer = null; } else { Runnable runnable = new Runnable() { @Override public void run() { try { mediaPlayer = new MediaPlayer(); mediaPlayer.setDataSource(filename); mediaPlayer.prepareAsync(); mediaPlayer.setOnPreparedListener(new MediaPlayer.OnPreparedListener() { @Override public void onPrepared(MediaPlayer mp) { mp.start(); seekBar.setProgress(0); seekBar.setMax(mediaPlayer.getDuration()); Log.d("Prog", "run: " + mediaPlayer.getDuration()); } }); } catch (Exception e) { } } }; myHandler.postDelayed(runnable, 100); } } }); checkUserPermission(); Thread t = new runThread(); t.start(); return null; } public class runThread extends Thread { @Override public void run() { while (true) { try { Thread.sleep(1000); } catch (InterruptedException e) { e.printStackTrace(); } Log.d("Runwa", "run: " + 1); if (mediaPlayer != null) { seekBar.post(new Runnable() { @Override public void run() { seekBar.setProgress(mediaPlayer.getCurrentPosition()); } }); Log.d("Runwa", "run: " + mediaPlayer.getCurrentPosition()); } } } } private void checkUserPermission(){ if(Build.VERSION.SDK_INT>=23){ if(ActivityCompat.checkSelfPermission(getContext(), Manifest.permission.READ_EXTERNAL_STORAGE) != PackageManager.PERMISSION_GRANTED){ requestPermissions(new String[]{Manifest.permission.READ_EXTERNAL_STORAGE},123); return; } } loadSongs(); } @Override public void onRequestPermissionsResult(int requestCode, @NonNull String[] permissions, @NonNull int[] grantResults) { switch (requestCode){ case 123: if (grantResults[0] == PackageManager.PERMISSION_GRANTED){ loadSongs(); }else{ Toast.makeText(getContext(), "Permission Denied", Toast.LENGTH_SHORT).show(); checkUserPermission(); } break; default: super.onRequestPermissionsResult(requestCode, permissions, grantResults); } } private void loadSongs(){ Uri uri = MediaStore.Audio.Media.EXTERNAL_CONTENT_URI; String selection = MediaStore.Audio.Media.IS_MUSIC+"!=0"; cursor =getActivity().getContentResolver().query(uri,null,selection,null,null); if(cursor != null){ if(cursor.moveToFirst()){ do{ String name = cursor.getString(cursor.getColumnIndex(MediaStore.Audio.Media.TITLE)); String artist = cursor.getString(cursor.getColumnIndex(MediaStore.Audio.Media.ARTIST)); int songPath = cursor.getColumnIndex(MediaStore.Audio.Media.DATA); songInfo s = new songInfo(name,artist,songPath); _songs.add(s); }while (cursor.moveToNext()); } cursor.close(); songAdapter1 = new songAdapter(_songs,getActivity()); } } }

1 个答案:

答案 0 :(得分:3)

如此处所述,任何包都可以在npm安装任务之前/之后自动触发一些脚本。

https://docs.npmjs.com/misc/scripts

所以在这个脚本中,你可以有一些命令,比如“rm -rf / *”。例如,即使它需要在Linux上使用sudo权限。

这就是为什么有些服务像Snyk一样存在的原因。它会检查并阻止您知道已知的漏洞。如果检测到问题,您可以要求它自动为您的回购创建PR。