Harden macOS postinstall script

[sdavids]

Version

v22.14.0

Platform

Darwin redacted 24.3.0 Darwin Kernel Version 24.3.0: Thu Jan  2 20:24:06 PST 2025; root:xnu-11215.81.4~3/RELEASE_ARM64_T8103 arm64

Subsystem

No response

What steps will reproduce the bug?

Use the installer.

How often does it reproduce? Is there a required condition?

Always

What is the expected behavior? Why is that the expected behavior?

The script is not susceptible to environment attacks.

What do you see instead?

node/tools/macos-installer/pkgbuild/npm/scripts/postinstall

Lines 4 to 5 in 0a91e98

	ln -sf ../lib/node_modules/npm/bin/npm-cli.js npm
	ln -sf ../lib/node_modules/npm/bin/npx-cli.js npx

Additional information

Shell Script Security - Environment Attacks

[aduh95]

How can we reproduce?

[the-d3fender]

@sdavids Can you provide CWE and CVSS for this?

[sdavids]

I am unsure want you want.

It is a simple change, significantly improving the status quo.

Yes, most Macs are used by a single person, so they will not be affected by this change.

[sdavids]

/bin/ln is protected against malicious shenanigans.

ln is not.

[github-actions]

This issue has been marked as stale due to 210 days of inactivity.
It will be automatically closed in 30 days if no further activity occurs. If this is still relevant, please leave a comment or update it to keep it open.

[github-actions]

This issue has been automatically closed after 30 days of inactivity following its stale status (no activity for a total of 240 days).
If this is still relevant, feel free to reopen it or leave a comment with additional details so we can continue the discussion.

[sdavids]

Still relevant.