News for hackers. Stuff that matters.

A comment on NPM lockfiles can be a security blindspot for injecting malicious modules in PRs. Parent comment

Re:NPM lockfiles can be a security blindspot for injecting m... by strken on Friday December 27, 2019 @03:08AM (#21889901)
If you have native dependencies, committing node_modules will break cross-compatibility with different platforms.
[ Parent | on HN ]
Re:NPM lockfiles can be a security blindspot for injecting m... by coding123 on Friday December 27, 2019 @09:02PM (#21896546)
That's exactly what we were hit with - a mix of Mac and PC developers and everything ploded (this was literally one of our first node projects about 5 years ago we didn't know to not commit node_modules)
[ Parent | on HN ]