Comment by Joker_vD

Comment by Joker_vD 7 days ago

2 replies

View on Hacker News

But the sl is not invoked by you. It is invoked by some npm module (a 5-times-removed dependency from any side) which hopes that either there is "sl" in the $PATH and it is the Sapling CLI, or there is no "sl" in the $PATH. This module can't use absolute paths because it does not know how the end user's system looks.

pasc1878 7 days ago

In that case it is a large security risk as well as it does not work as per the article

Reply View 1 reply
  • Joker_vD 6 days ago

    A program invoking some other the program that the user themself consciously have installed on their system (and put into the PATH) is not a security risk per se, it's literally UNIX Way™ working as intended.

    Reply View 0 replies