We All Dodged a Bullet

Re:We All Dodged a Bullet by scotty79 on Tuesday September 09, 2025 @12:19PM (#45184234)

Is there a tool that you can put between your npm client and npm web servers that serves package versions that are month old and possibly also tracks discovered malware and never serves infected versions?

[ Parent | on HN ]

Re:We All Dodged a Bullet by JackFr on Tuesday September 09, 2025 @12:44PM (#45184650)

Artifactory. Nexus. I believe AWS/GCP/Azure have offerings.

No bank, and almost no large corporations go directly to artifact/package repos. They all host them internally.

[ Parent | on HN ]

Re:We All Dodged a Bullet by darthwalsh on Wednesday September 10, 2025 @11:40PM (#45207523)

Yes, but the public npmjs repository also blocks our corporate IP addresses, so our CI/CD pipelines can't ruin npm for everybody else.

[ Parent | on HN ]

Re:We All Dodged a Bullet by lovehashbrowns on Tuesday September 09, 2025 @01:48PM (#45185616)

I'm looking at Verdaccio currently, since Artifactory is expensive and I think the CE version still only supports C++. Does anyone have any experience with Verdaccio?

[ Parent | on HN ]

Re:We All Dodged a Bullet by balder1991 on Tuesday September 09, 2025 @12:41PM (#45184597)

Something like this? https://jfrog.com/artifactory/

[ Parent | on HN ]

Re:We All Dodged a Bullet by singulasar on Tuesday September 09, 2025 @01:13PM (#45185106)

the company that first found this vulnerability also has a tool for this https://www.npmjs.com/package/@aikidosec/safe-chain

[ Parent | on HN ]

Re:We All Dodged a Bullet by mikebelanger on Wednesday September 10, 2025 @07:26AM (#45196126)

Artifactory works fairly well. Although admittedly, when a user grabs a new dependency, they're downloading from the npmjs registry like anyone else.

Really, the killer combo would be to have some kind of LLM-based tool that would scan someone's artifactory. Something smart enough to notice that code changed, and there's code for accessing a crypto-wallet, etc. This would be too expensive for npmjs to host for free, but I could see this happen to hosted artifactory dependencies.

[ Parent | on HN ]