3 ms·
I have a package on NPM which is only partially implemented, using it in a production app is a bad idea, a quick glance at the source code or the todo section o
by crispyporkbites 9y ago
I have a package on NPM which is only partially implemented, using it in a production app is a bad idea, a quick glance at the source code or the todo section of the readme makes it pretty obvious. I still gets bug reports and npm says it has hundreds of download every month.
For anything serious, read the source code, at the very least check your dependencies.
- ag_dubs 9y agofwiw as a former npm registry engineer i can tell u that "hundreds of download every month" likely is a result of the background bot activity npm gets. but your advice is sound! definitely vet your deps before you use them! and YES! read the source.
- probablycorey 9y agoIs this realistic though? Every time you update a dependency you would have to read its source (and its source dependencies, and their source dependencies...) To do that well, it would be someone's fulltime job to read and do security audits on all those dependencies.
- illustrioussuit 9y agoTheoretically, once something is updated all you would have to do is check the diff. Still tedious though.
- Y_Y 9y agoI look forward to all the clever exploits that result from benign-looking code being added to benign-looking code.
- komali2 9y agoLast time I went to one of the Bay Area node meetups, that given meetup was being sponsored by just such a company. Can't remember the name, unfortunately. The idea was though that you'd feed them your package.json and they'd let you know of any vulnerabilities, iirc. Or maybe they had a private repo of packages they'd checked? Can't remember.
- tomsmeding 9y agoPossibly https://snyk.io/ https://snyk.io/ ?
- mpolichette 9y agoThe argument in that article is that it doesn't matter what is in the source. The published package has no guarantees to be from the source.