Re:Backdoor in event-stream library dependency
by dmortin on Monday November 26, 2018 @12:11PM
(#18534858)
Dependencies need bugfixes and you may even want to use new features, so locking is not a permanent solution.
[ Parent
| on HN ]
Re:Backdoor in event-stream library dependency
by twodave on Monday November 26, 2018 @12:18PM
(#18534933)
If you're on point enough to know which features/bugfixes you're getting then you're probably doing enough to be safe already. Just don't go around running npm -u for no reason and you should be fine.
The only way to be truly safe from this attack vector is to own all of your dependencies, and nobody is willing to do that so we're all assuming some amount of risk.