NPM lockfiles can be a security blindspot for injecting malicious modules in PRs

Re:NPM lockfiles can be a security blindspot for injecting m... by CGamesPlay on Friday December 27, 2019 @01:01AM (#21889539)

> avoid breakage through things like minor version updates of your first level dependencies?

No, a much more useful use case is avoid breakage from minor version updates in your 15th level dependencies. You might be cognizant of your semver best practices, but the team who publishes the string utility library included by the query builder included by your ORM might not be so careful.

[ Parent | on HN ]

Re:NPM lockfiles can be a security blindspot for injecting m... by allover on Friday December 27, 2019 @03:44AM (#21890015)

> No,

I think you mean "Yes, but also ..."

[ Parent | on HN ]

Re:NPM lockfiles can be a security blindspot for injecting m... by CGamesPlay on Friday December 27, 2019 @03:48AM (#21890035)

I don't really. If you only wanted to control your first-level dependencies, you would simply not use caret and tilde ranges in your package.json, no lockfile needed (except for cryptographic verification).

[ Parent | on HN ]

Re:NPM lockfiles can be a security blindspot for injecting m... by allover on Friday December 27, 2019 @04:11AM (#21890109)

> I don't really. If you only wanted to control your first-level dependencies

They didn't say "only", they said "things like".

[ Parent | on HN ]