Embedded Malicious Code in node-ipc

Re:Embedded Malicious Code in node-ipc by Gigachad on Sunday March 20, 2022 @06:19PM (#30747282)

NPM tells me that just about everything is a security issue. Apparently my linter has a critical security issue because I could put a malicious regex in my own linter config causing it to waste cpu..

[ Parent | on HN ]

Re:Embedded Malicious Code in node-ipc by throwaway984393 on Sunday March 20, 2022 @09:02PM (#30748792)

You can also check the CVE and see if it's critical (or if it even affects your application) and wait if it's not. Security literacy makes your life easier.

[ Parent | on HN ]

Re:Embedded Malicious Code in node-ipc by UncleMeat on Monday March 21, 2022 @08:51AM (#30753492)

This works for OSS code but not for all dependencies in general. That SDK or whatever you are using likely isn't getting CVEs filed on it.

[ Parent | on HN ]