Npm security post-mortem

Re:Npm security post-mortem by jmspring on Friday March 21, 2014 @05:42PM (#7445125)

So the audit was mostly about nom the website and the service for maintaining npm packages? That's a good first step.

Has there been any talk within the node community about auditing node modules themselves? Maybe start with the most popular? I could see this being popular with enterprise development, etc.

I want to say that Strong Loop made noise about doing something like this, but I haven't seen much on it of late.

[ Parent | on HN ]

Re:Npm security post-mortem by daviddias on Friday March 21, 2014 @07:25PM (#7445645)

One of the Node Security Project (https://nodesecurity.io/) main efforts is to audit all the npm modules in a community driven way.

We are accepting contributions from the community to build the tools that get the job done efficiently and to audit modules, disclosing vulnerabilities in a responsible manner.

[ Parent | on HN ]

Re:Npm security post-mortem by jmspring on Friday March 21, 2014 @09:28PM (#7446538)

I'll take a look, thanks. Some reviews will, of course, be manual in nature -- implementation correctness of digest auth, for instance, is one that comes to mind (I need to contribute that back to a particular module).

[ Parent | on HN ]