News for hackers. Stuff that matters.

A comment on NPM lockfiles can be a security blindspot for injecting malicious modules in PRs. Parent comment

Re:NPM lockfiles can be a security blindspot for injecting m... by korla on Friday December 27, 2019 @01:36AM (#21889638)
All of these (except 3) also get solved by moving dependencies to a hosted npm registry. Something which has been suitable for some projects I’ve worked on. And keeps ’git clone’-times down.
[ Parent | on HN ]
Re:NPM lockfiles can be a security blindspot for injecting m... by leipert on Friday December 27, 2019 @08:59PM (#21896535)
Well, not necessarily. Basically you create a new dependency and a piece of infrastructure _you_ need to maintain and that often still relies on yarn/npm upstream registries.

So if that part of the infrastructure is down, you cannot work. A repo might be more error resilient, because if you check it out, you check it out.

[ Parent | on HN ]