3 ms·
Unfortunately in this case, since the source repository itself wasn't compromised, there was nothing to audit (assuming the final bundle was packed/minified).
by _bxg1 8y ago
Unfortunately in this case, since the source repository itself wasn't compromised, there was nothing to audit (assuming the final bundle was packed/minified).
One interesting mitigation would be for NPM to allow you to bind your package directly to a particular repo. So rather than a user (or job system) having to manually go in and publish releases, NPM could assure that what's live always matches what's in the repo.
I've always wondered, how does apt-get solve this? Do they audit every package?
- rattray 8y agoYeah, `npm publish` should just – on npm's servers – fetch a github repo and run a build command. This would be more secure, convenient, and less prone to silly errors (like forgetting to build before releasing).
- namibj 8y agoThey build them themselves, and vet holders of signing keys. They have _much_ better opsec than the NPM ecosystem.