News for hackers. Stuff that matters.

A comment on NPM lockfiles can be a security blindspot for injecting malicious modules in PRs. Parent comment

Re:NPM lockfiles can be a security blindspot for injecting m... by allover on Friday December 27, 2019 @03:44AM (#21890015)
> No,

I think you mean "Yes, but also ..."

[ Parent | on HN ]
Re:NPM lockfiles can be a security blindspot for injecting m... by CGamesPlay on Friday December 27, 2019 @03:48AM (#21890035)
I don't really. If you only wanted to control your first-level dependencies, you would simply not use caret and tilde ranges in your package.json, no lockfile needed (except for cryptographic verification).
[ Parent | on HN ]
Re:NPM lockfiles can be a security blindspot for injecting m... by allover on Friday December 27, 2019 @04:11AM (#21890109)
> I don't really. If you only wanted to control your first-level dependencies

They didn't say "only", they said "things like".

[ Parent | on HN ]