3 ms·
> 3. Warn when the dependency tree goes too deep (8 or 9 levels of deps) Hmm, why? > 4. Better auditing of suspicious patterns (accessing .npmrc should throw
by inglor 8y ago
> 3. Warn when the dependency tree goes too deep (8 or 9 levels of deps)
Hmm, why?
> 4. Better auditing of suspicious patterns (accessing .npmrc should throw a flag)
As in - when `.npmrc` is accessed as a result of `npm install` you would want NPM to warn?
- vorpalhex 8y agoI can't imagine most modules need to read or write your .npmrc directly (npm itself does). That should flag a module (with the understanding that I'm sure there's some modules that do legitimately need that access - eg to easily swap which registry you're publishing too). When a dependency tree starts going too deep, it's too easy for malicious modules to get snuck in. You pull in Popular Library X which depends on well-known module A, which in turn pulls in shim B, which in turn depends on an unpinned utility C. Somebody sneaks a malicious hook into utility C which isn't used directly by anybody really, but propagates the malicious code to all the users of Popular Library X (eg Babel).