News for hackers. Stuff that matters.
Re:A Single Vulnerability Can Bring Down the JavaScript Ecos... by Tade0 on Saturday June 08, 2024 @04:17PM (#40619958)
I half want to say "again?".

Anyway, one properly mad technique shielding against all npm-related problems that I've seen being used was to include node_modules in the repo.

Terrible, yes, but was a real life-saver when the left-pad issue hit.

Terrible, yes, but was a real life saver

Re:A Single Vulnerability Can Bring Down the JavaScript Ecos... by dimava on Saturday June 08, 2024 @07:45PM (#40620906)
With Yarn it always was a bit easier[1] as all you have to do is to git-include `.yarn/cache` that contains package zips

[1] https://yarnpkg.com/features/caching#offline-mirror