3 ms·
Integrating nsp is a very welcome move. It's heartening to see npm taking the security issue seriously and taking steps to start addressing the problem. That s
by segphault 8y ago
Integrating nsp is a very welcome move. It's heartening to see npm taking the security issue seriously and taking steps to start addressing the problem.
That said, the problem remains largely cultural rather than technical. The community needs to make significant changes to how it consumes and publishes dependencies in order to reduce the attack surface. The massive, bloated dependency graphs that developers who use Node tolerate with cavalier indifference are not safe or sustainable in the long term.
- Flenser 8y agoHopefully increased awareness of insecure dependencies among users will increase reporting of them to dependant projects, which will encourage some or all of the following behaviours: 1) projects to keep their dependencies up-to-date 2) projects to use less dependencies 3) consuming projects to switch their dependencies to ones that do the above 4) users to switch to projects that do the above It would be interesting to track the average number of dependencies (total number in dependencies in the graph) over time to see how it is changing.