RCE-NPM

A touch of security

RCE? Postinstall?

Not your cup of tea?(mine too)

This Repo has Code to open Calculator Once when someone runs

npm install git+https://github.com/slvignesh05/RCE-NPM.git

Remote Code Execute Sire?

Yes.(RCE ya)

Package.json

"name":vul_name
"version":0.2.2
"scripts":{
     "postinstall": "node payload.js"
}

Here the postinstall triggers the code on payload.js to run malicious code(in this example to open Calculator)