Zed downloads NodeJS binary and npm packages from Internet without user’s consent
### Check for existing issues - [X] Completed ### Describe the bug / provide steps to reproduce it I noticed that Zed automatically downloads the NodeJS binary from https://nodejs.org without asking or even informing the user about it. Right after starting it and opening a file, without doing anything else. And there’s no option to disable it. This is completely unacceptable! Not just for security reasons but also from a usability point of view. I’m currently connected via metered LTE, and Zed has just eaten up 14 MiB of my plan. Moreover, I already have node installed and on PATH. Also, the downloaded binary is somehow corrupted and it wouldn’t work on my system anyway because it’s built against glibc (that’s how I noticed it in the first place). And to make matters worse, if it did work, it would start installing arbitrary packages from npmjs.com via npm and running their scripts. This represents a huge attack vector. This approach is completely unacceptable for anyone who’s concerned about cybersecurity and for virtually all companies, at least in the EU, because of cybersecurity laws, related certifications and audits. EDIT: Now I found that it downloads ([here](https://github.com/zed-industries/zed/blob/de8ef081436317689333b29324b3a64343745914/crates/supermaven_api/src/supermaven_api.rs#L189)) even some _proprietary_ binary from https://supermaven.com, i.e. unaudited and unauditable code, without any verification (except TLS)! At least this is not downloaded by d
Posted by jirutka on Jun 2, 2024, 5:01 PM
Tags
Related issues
- [UPDATE NOW] PHP RCE Vulnerability (CVE-2026-109618 and CVE-2026-109619)
- Server requests and latency increased after upgrading from Next.js 15 to 16
- Leak of Geedge Networks internal documents (100,000+ from Jira, Confluence, GitLab)
- Can't download videos from YouTube on cobalt.tools
- `google_service_networking_connection` produce an error when trying to destroy the resource
- WebGPU-based renderer for the editor
Raise real-world problems, find people facing the same issue, and discuss solutions.2,000 issues0 comments
github (Network)
[UPDATE NOW] PHP RCE Vulnerability (CVE-2026-109618 and CVE-2026-109619)
Server requests and latency increased after upgrading from Next.js 15 to 16
Leak of Geedge Networks internal documents (100,000+ from Jira, Confluence, GitLab)
Can't download videos from YouTube on cobalt.tools
`google_service_networking_connection` produce an error when trying to destroy the resource
WebGPU-based renderer for the editor
Zed downloads NodeJS binary and npm packages from Internet without user’s consent
FR: Allow custom domains for Tailscale Funnel
Zed downloads NodeJS binary and npm packages from Internet without user’s consent
### Check for existing issues - [X] Completed ### Describe the bug / provide steps to reproduce it I noticed that Zed automatically downloads the NodeJS binary from https://nodejs.org without asking or even informing the user about it. Right after starting it and opening a file, without doing anything else. And there’s no option to disable it. This is completely unacceptable! Not just for security reasons but also from a usability point of view. I’m currently connected via metered LTE, and Zed has just eaten up 14 MiB of my plan. Moreover, I already have node installed and on PATH. Also, the downloaded binary is somehow corrupted and it wouldn’t work on my system anyway because it’s built against glibc (that’s how I noticed it in the first place). And to make matters worse, if it did work, it would start installing arbitrary packages from npmjs.com via npm and running their scripts. This represents a huge attack vector. This approach is completely unacceptable for anyone who’s concerned about cybersecurity and for virtually all companies, at least in the EU, because of cybersecurity laws, related certifications and audits. EDIT: Now I found that it downloads ([here](https://github.com/zed-industries/zed/blob/de8ef081436317689333b29324b3a64343745914/crates/supermaven_api/src/supermaven_api.rs#L189)) even some _proprietary_ binary from https://supermaven.com, i.e. unaudited and unauditable code, without any verification (except TLS)! At least this is not downloaded by d
Comments (0)
No comments yet. Start the discussion.