News for hackers. Stuff that matters.

A comment on You too can run malware from NPM (I mean without consequences). Parent comment

Re:You too can run malware from NPM (I mean without conseque... by rs186 on Tuesday September 09, 2025 @09:29AM (#45181656)
Sure, it should never happen in CI environment. But I bet that every second, someone in the world is running "npm install" to bring in a new dependency to a new/existing project, and the impact of a malicious release can be broad very quickly. Vibe coding is not going to slow this down.
[ Parent | on HN ]
Re:You too can run malware from NPM (I mean without conseque... by naugtur on Tuesday September 09, 2025 @09:58AM (#45182000)
Vibe coding brings up the need for even more granular isolation. I'm on it ;)

LavaMoat Webpack Plugin will soom have the ability to treat parts of your app same as it currently treats packages - with isolation and policy limiting what they can do.

[ Parent | on HN ]