News for hackers. Stuff that matters.

A comment on NPM lockfiles can be a security blindspot for injecting malicious modules in PRs. Parent comment

Re:NPM lockfiles can be a security blindspot for injecting m... by crtlaltdel on Thursday December 26, 2019 @08:37PM (#21888392)
Before lockfiles I would pin version in my package.json file. Now, I still pin version in my package.json file ;)
[ Parent | on HN ]
Re:NPM lockfiles can be a security blindspot for injecting m... by fiddlerwoaroof on Friday December 27, 2019 @12:00AM (#21889333)
package-lock is for pinning transitive dependencies, which package.json has no control over
[ Parent | on HN ]