4 ms·
They could just put malware into one of popular node.js modules. Nobody would notice because Linux/Mac users don't use antivirus.
by codedokode 10y ago
They could just put malware into one of popular node.js modules. Nobody would notice because Linux/Mac users don't use antivirus.
- giancarlostoro 10y agoSomeone might notice a random blob or just during code review. Someone has to approve a pull request.
- auspex 10y agoThis is why most companies have a build step in their CI/CD pipeline that scans for CVE/malware in their app's dependencies (jar, npm packages, Ruby gems etc)
- srd 10y agoWhile the concept sounds sound, so far I've never actually seen this setup in the real world. Do you happen to have any resources on how to properly setup such a step in a CI tool?
- auspex 10y agoCheck out software like Twistlock, Sonatype and I think Tennable has a scanner as well that integrates into the pipeline. If your are not using Sonatype to build you can find good support for this in Jenkins or Team City via a plugin (Full disclosure, I work in this area)