Re:Where is all the Node.js malware?
by lancestout on Monday June 03, 2013 @01:36AM
(#5811557)
This is actually goes to the point behind the http://nodesecurity.io initiative - building up the security mindedness of the node community by auditing npm modules for various vulnerabilities and making it easy to responsibly disclose vulnerabilities to module maintainers [1].
We're in the process for the first audit wave (checking for things like child_process.exec), and have already had several modules get patched.
IIRC, the npm maintainers have expressed interest at the recent node confs/meetups about incorporating security advisory information into the npm package results, to alert people about potential issues when installing modules.
We're in the process for the first audit wave (checking for things like child_process.exec), and have already had several modules get patched.
IIRC, the npm maintainers have expressed interest at the recent node confs/meetups about incorporating security advisory information into the npm package results, to alert people about potential issues when installing modules.
[1] http://blog.liftsecurity.io/post/52010883123/security-md-imp...