Anders Kaseorg 43c8c720ef node_cache: Run yarn with --ignore-scripts. ... As predicted in https://www.kb.cert.org/vuls/id/319816/, a malicious worm is beginning to spread across the npm ecosystem through package postinstall scripts. Only instead of direct self-replicating code, the replication vector is the temptation to monetize postinstall scripts by polluting the console logs with paid advertisements. The effect will be the same unless we all put a stop to this while we still can. Apply the recommended VU#319816 workaround, which is to disable lifecycle scripts when installing npm packages. The only fallout is: * node-sass can’t run because it uses compiled native code; we replace it with Dart Sass. * phantomjs-prebuilt doesn’t download the binary at install time; we tell it to download it in run-casper. * ttf2woff2 transparently falls back from native code to an Emscripten build. Signed-off-by: Anders Kaseorg <anders@zulipchat.com>		2019-08-26 14:36:03 -07:00
..
casper_lib	eslint: Add key-spacing linter rule.	2018-12-18 10:41:06 -08:00
casper_tests	populate_db: Extract internal realm creation into a function.	2019-08-23 12:57:24 -07:00
node_tests	notifications: Add 'none' to unread count options.	2019-08-25 21:29:10 -07:00
zjsunit	zjsunit: Add support for using i18n without escaping.	2019-08-01 12:58:11 -07:00
.eslintrc.json	lint: Check eslint indentation for casper tests.	2018-05-06 19:35:18 -07:00
run-casper	node_cache: Run yarn with --ignore-scripts.	2019-08-26 14:36:03 -07:00