Backdoor in event-stream library dependency

Re:Backdoor in event-stream library dependency by g-harel on Monday November 26, 2018 @12:21PM (#18534964)

NPM needs to make accessing the source code easier. It has always bothered me that the linked repository can be set to absolutely anything the author wants.

[ Parent | on HN ]

Re:Backdoor in event-stream library dependency by mifreewil on Monday November 26, 2018 @05:03PM (#18537241)

I think something like an npm diff command would be helpful. This would allow you to see the changes from a previous version that you just upgraded from. This would somewhat replicate the functionality that commiting your node_modules directory to git would give you.

[ Parent | on HN ]

Re:Backdoor in event-stream library dependency by shados on Monday November 26, 2018 @04:57PM (#18537206)

Not sure how that would help. Anyone can publish anything to npm, it doesn't even need a repository. So unless the source code itself was hosted on npm, and the entire toolchain was controlled by npm, there's not much to do.

[ Parent | on HN ]

Re:Backdoor in event-stream library dependency by g-harel on Wednesday November 28, 2018 @01:46AM (#18549715)

Exactly, I think a source code browser on https://www.npmjs.com/ would be nice to have

[ Parent | on HN ]