Harden macOS postinstall script #57660
Description
Version
v22.14.0
Platform
Darwin redacted 24.3.0 Darwin Kernel Version 24.3.0: Thu Jan 2 20:24:06 PST 2025; root:xnu-11215.81.4~3/RELEASE_ARM64_T8103 arm64
Subsystem
No response
What steps will reproduce the bug?
Use the installer.
How often does it reproduce? Is there a required condition?
Always
What is the expected behavior? Why is that the expected behavior?
The script is not susceptible to environment attacks.
What do you see instead?
node/tools/macos-installer/pkgbuild/npm/scripts/postinstall
Lines 4 to 5 in 0a91e98
Activity
aduh95 commentedon Mar 28, 2025
How can we reproduce?
the-d3fender commentedon Mar 29, 2025
@sdavids Can you provide CWE and CVSS for this?
sdavids commentedon Mar 29, 2025
I am unsure want you want.
It is a simple change, significantly improving the status quo.
Yes, most Macs are used by a single person, so they will not be affected by this change.
sdavids commentedon Mar 29, 2025
/bin/lnis protected against malicious shenanigans.lnis not.tools: delete macos installer postinstall script
github-actions commentedon Apr 20, 2026
This issue has been marked as stale due to 210 days of inactivity.
It will be automatically closed in 30 days if no further activity occurs. If this is still relevant, please leave a comment or update it to keep it open.
github-actions commentedon May 21, 2026
This issue has been automatically closed after 30 days of inactivity following its stale status (no activity for a total of 240 days).
If this is still relevant, feel free to reopen it or leave a comment with additional details so we can continue the discussion.
sdavids commentedon May 21, 2026
Still relevant.