News for hackers. Stuff that matters.

A comment on NPM lockfiles can be a security blindspot for injecting malicious modules in PRs. Parent comment

Re:NPM lockfiles can be a security blindspot for injecting m... by fiddlerwoaroof on Friday December 27, 2019 @12:00AM (#21889333)
package-lock is for pinning transitive dependencies, which package.json has no control over
[ Parent | on HN ]

There are no comments on this comment yet.