Ask HN: How do you security-audit external software using NPM packages?

Re:Ask HN: How do you security-audit external software using... by roofwellhams on Thursday November 04, 2021 @03:58AM (#29104476)

If you don't use node, what do you use? You will have the exact same problems if you want to use a library.

[ Parent | on HN ]

Re:Ask HN: How do you security-audit external software using... by aww_dang on Thursday November 04, 2021 @04:09AM (#29104548)

For js libraries, I generally prefer something that offers a prebuilt package. If I need to use NPM just to include a Javascript file on a webpage, I generally look elsewhere. Same with CSS themes.

For command line tools and packages that require Node, again I generally look elsewhere. Dealing with a rest API on a command line shouldn't require so much bloat.

If a tool requires Node as part of a build script, I avoid it like the plague.

In other cases, I use a VM to build the JS package, but I honestly dread this workflow. Whenever a README/INSTALL contains, "Just npm our package..." or "first install node, then npm our helper utilities..." I start looking for alternatives.

Maybe I'm becoming a curmudgeon and maybe my dislike of Node is irrational, but this is how I'm coping.

[ Parent | on HN ]

Re:Ask HN: How do you security-audit external software using... by dgb23 on Thursday November 04, 2021 @07:42AM (#29105844)

What would you rather download assuming you don't know if you can trust the author: The source files of a program or a distributed binary?

[ Parent | on HN ]