News for hackers. Stuff that matters.
Re:Netmask NPM package, used by 270k+ projects, vulnerable t... by golergka on Monday March 29, 2021 @09:36AM (#26621321)
Depends on the library in question. I don't think that lodash doesn't get enough eyeballs on it.
Re:Netmask NPM package, used by 270k+ projects, vulnerable t... by mikepurvis on Monday March 29, 2021 @09:54AM (#26621573)
Well yes, but the point is that everything in the stdlib receives scrutiny and a long-term commitment to mainenance/upkeep. A small proportion of pypi/npm receives these things, but the vast majority is abandonware trash. You only have to briefly scroll through the main PyPI index to realise just how awful it is:

https://pypi.org/simple/ (caution— multi-megabyte html)

Re:Netmask NPM package, used by 270k+ projects, vulnerable t... by oblio on Monday March 29, 2021 @09:53AM (#26621555)
Lodash might, or might not, offer the same guarantees that a stdlib generally offers: backwards and forwards compatibility, a clear deprecation and removal schedule, etc.

It's great to have high quality third party libraries but stuff like most of lodash should be in a stdlib, already.

Re:Netmask NPM package, used by 270k+ projects, vulnerable t... by dmos62 on Monday March 29, 2021 @09:51AM (#26621517)
You have a point there, but if you have a very well vetted third-party library that provides things as basic as IP address parsing, you'll probably see that library included into the official library package.