News for hackers. Stuff that matters.

A comment on Malicious crossenv package on npm. Parent comment

Re:Malicious crossenv package on npm by raggi on Thursday August 03, 2017 @03:41AM (#14917697)
Npm being split means more metadata, not necessarily more code. You admit to not reading your code or inspecting your dep, and you assert that you have no problems - based on what?

Your deps.txt is barely different than a lock file here.

Reading the code from dependencies is not really hard anywhere here.

[ Parent | on HN ]
Re:Malicious crossenv package on npm by thehardsphere on Thursday August 03, 2017 @10:00AM (#14919606)
> you assert that you have no problems - based on what?

The software works as intended and I know that my dependencies have not changed without me explictly changing them.

> Your deps.txt is barely different than a lock file here.

That command produces a tree of all dependencies and their dependencies. I don't know what that has to do with a lock file.

[ Parent | on HN ]