News for hackers. Stuff that matters.

A comment on Deno 1.9. Parent comment

Re:Deno 1.9 by felixfbecker on Wednesday April 14, 2021 @05:33AM (#26804796)
No they could not. Because your package-lock.json contains integrity hashes that are verified during installation.
[ Parent | on HN ]
Re:Deno 1.9 by Soremwar on Wednesday April 14, 2021 @03:32PM (#26811934)
Only if you update dependencies, a fresh install would not have such integrity checks, so it's just as vulnerable as Deno hosts to such attacks
[ Parent | on HN ]