Tell HN: Until recently, `npm i -g serverless` modified your shell's RC

3 points

6 years ago

Quick PSA: if you globally installed the Serverless npm package in the last 2 years you may want to check your shell's RC. I was shocked to discover it modifies your shell's startup to source its own scripts without any chance for audit.

This was finally resolved in October but an open issue for years. https://github.com/serverless/serverless/issues/4069

Here's what serverless adds to `.config/fish` for example:

    # tabtab source for serverless package
    # uninstall by removing these lines or running `tabtab uninstall serverless`
    [ -f /usr/local/lib/node_modules/serverless/node_modules/tabtab/.completions/serverless.fish ]; and . /usr/local/lib/node_modules/serverless/node_modules/tabtab/.completions/serverless.fish
    # tabtab source for sls package
    # uninstall by removing these lines or running `tabtab uninstall sls`
    [ -f /usr/local/lib/node_modules/serverless/node_modules/tabtab/.completions/sls.fish ]; and . /usr/local/lib/node_modules/serverless/node_modules/tabtab/.completions/sls.fish
    # tabtab source for slss package
    # uninstall by removing these lines or running `tabtab uninstall slss`
    [ -f /usr/local/lib/node_modules/serverless/node_modules/tabtab/.completions/slss.fish ]; and . /usr/local/lib/node_modules/serverless/node_modules/tabtab/.completions/slss.fish

1 comment