Re:Npm security post-mortem
by daviddias on Friday March 21, 2014 @07:25PM
(#7445645)
One of the Node Security Project (https://nodesecurity.io/) main efforts is to audit all the npm modules in a community driven way.
We are accepting contributions from the community to build the tools that get the job done efficiently and to audit modules, disclosing vulnerabilities in a responsible manner.
Re:Npm security post-mortem
by jmspring on Friday March 21, 2014 @09:28PM
(#7446538)
I'll take a look, thanks. Some reviews will, of course, be manual in nature -- implementation correctness of digest auth, for instance, is one that comes to mind (I need to contribute that back to a particular module).
We are accepting contributions from the community to build the tools that get the job done efficiently and to audit modules, disclosing vulnerabilities in a responsible manner.