Skip to content

fix: prevent pluginloader.js from removing globally installed packages#404

Open
SARTHAK2427 wants to merge 1 commit intoneutralinojs:mainfrom
SARTHAK2427:fix/global-uninstall-vulnerability
Open

fix: prevent pluginloader.js from removing globally installed packages#404
SARTHAK2427 wants to merge 1 commit intoneutralinojs:mainfrom
SARTHAK2427:fix/global-uninstall-vulnerability

Conversation

@SARTHAK2427
Copy link
Copy Markdown

Description

This PR fixes an issue where the CLI unintentionally removed globally installed npm packages during plugin removal

The current implementation uses npm rm -g, which removes packages from the global environment instead of limiting the operation to the CLI or project scope. This leads to unintended system-wide deletions. During testing, a globally installed package was removed after running the plugin removal command

Fixes #403

Changes

  • Replaced the global uninstall command (npm rm -g) with a safer alternative to prevent unintended removal of globally installed packages.
npm unlink ${pluginName}
  • Added Existence Validation: Implemented a check to verify the plugin exists before removal. If a plugin is missing, the CLI now provides a clean neu: ERRR Unable to find plugin error instead of a stack trace crash
if (!plugins.includes(pluginName)) {
    utils.error(`Unable to find plugin: ${pluginName}`);
    process.exit(1);
}

if (isPluginInstalled(pluginName)) {
    await execAsync(`npm unlink ${pluginName}`);
}

@SARTHAK2427
Copy link
Copy Markdown
Author

@shalithasuranga please review this pr

@SARTHAK2427 SARTHAK2427 force-pushed the fix/global-uninstall-vulnerability branch from 683053c to 7c4abe6 Compare April 3, 2026 00:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

pluginloader.js removes globally installed npm packages during plugin uninstalling

1 participant