Embedded Malicious Code in node-ipc

Re:Embedded Malicious Code in node-ipc by throwaway984393 on Sunday March 20, 2022 @05:46PM (#30747000)

> what can be done to address this type of issue?

Only auto-upgrade for security fixes. For all others, wait between month to a year to update a dependency, unless one specifically fixes a bug you are experiencing.

[ Parent | on HN ]

Re:Embedded Malicious Code in node-ipc by Gigachad on Sunday March 20, 2022 @06:19PM (#30747282)

NPM tells me that just about everything is a security issue. Apparently my linter has a critical security issue because I could put a malicious regex in my own linter config causing it to waste cpu..

[ Parent | on HN ]

Re:Embedded Malicious Code in node-ipc by throwaway984393 on Sunday March 20, 2022 @09:02PM (#30748792)

You can also check the CVE and see if it's critical (or if it even affects your application) and wait if it's not. Security literacy makes your life easier.

[ Parent | on HN ]

Re:Embedded Malicious Code in node-ipc by UncleMeat on Monday March 21, 2022 @08:51AM (#30753492)

This works for OSS code but not for all dependencies in general. That SDK or whatever you are using likely isn't getting CVEs filed on it.

[ Parent | on HN ]