News for hackers. Stuff that matters.

A comment on Ask HN: How do you security-audit external software using NPM packages?.

Re:Ask HN: How do you security-audit external software using... by TheRealBrianF on Thursday November 04, 2021 @10:46AM (#29107854)
Sonatype Lifecycle is designed to analyze a built package and figure out what's inside it, specifically when there aren't manifest files to tell you what's -supposed- to be there. It can obviously do a lot more, but the analysis is designed to solve the exact problem you're describing.

https://blog.sonatype.com/mapping-the-javascript-genome-for-...

[ Parent | on HN ]
Re:Ask HN: How do you security-audit external software using... by chha on Thursday November 11, 2021 @08:46AM (#29187766)
Yeah, currently in the process of evaluating Lifecycle, Firewall and Repository. Impression so far is great, and coming from an org where everything is blocked by default having these tools in place is night/day for us...
[ Parent | on HN ]
Re:Ask HN: How do you security-audit external software using... by BjornW on Thursday November 04, 2021 @11:12AM (#29108185)
Will have a look at this. Thanks for sharing.
[ Parent | on HN ]