4 ms·
Ideas for improvement: - Add 2 factor authentication for npm publish - When you npm install, add a warning for all the versions that got published without 2 f
by vjeux 11y ago
Ideas for improvement:
- Add 2 factor authentication for npm publish
- When you npm install, add a warning for all the versions that got published without 2 fac
- pre-install/post-install scripts should require user to accept or refuse. The simple action of running npm install shouldn't run arbitrary code.
- make shrinkwrap by default (and fix all the issues with it) so that running npm install doesn't use different versions when used over time.
- make updating a version an explicit decision via npm upgrade
- deleted 11y ago[deleted]
- d0m 11y agoHmm, how does that help? User A: Publish package X1.0 (with 2 factor auth) User B: Download with npm package X1.0 User A: Unpublish package. User C: Publish package X1.0, malware code (with a different 2 factor auth) User B: Somewhere else, download and install package X1.0 For that to work, every package should be signed in package.js so that when you download a different version, you know about it. Also, I don't think it should be possible to alter previous versions. Package X1.0 should always be X1.0. EDIT: Seems like it's impossible to re-upload X1.0, which fix this issue. I thought once a package was unpublished, it was possible to republish the exact same version.
- STRML 11y agoWhen a package transfers ownership or is removed/re-added, it's not possible to republish the same version as one that has previously existed. Of course, this doesn't save you if you're installing `^1.0.0`, the maintainer deletes the package, and someone else uploads a malicous `1.0.1`. The package.json should allow pinning publisher usernames and optionally public keys, and shrinkwrap should pin hashes, not just versions.
- d0m 11y agoI edited my post while you were writing yours ;-) Thanks for the clarification.