News for hackers. Stuff that matters.

A comment on GitHub Advisory Database now powers NPM audit. Parent comment

Re:GitHub Advisory Database now powers NPM audit by onion2k on Thursday October 07, 2021 @05:16PM (#28792215)
So do I, so when a tool tells me there's a ddos vector in a devdependency that never gets put on a live server I ignore it. If it happens a lot I start to ignore all those warnings. If that leads me to ignore a real warning then the warning has had a negative impact.

If you ever heard the story of "The Boy Who Cried Wolf" as a child you should recognise what npm audit is doing wrong.

[ Parent | on HN ]
Re:GitHub Advisory Database now powers NPM audit by kkirsche on Friday October 08, 2021 @07:15AM (#28797928)
Your company may care about it. Endpoints are as common a vector for attacks as the server is. As a penetration tester, I’ve used DoS vectors before to make a developer think they needed their password to kill an app, and stole their credentials to then breach their other assets. If you think the server is all that matters, you are a good target in my eyes.
[ Parent | on HN ]