4 ms·
True, but they can compromise the machine that runs VuePress (or at least, run arbitrary userlevel JS code on it).
by l_t 8y ago
True, but they can compromise the machine that runs VuePress (or at least, run arbitrary userlevel JS code on it).
- ncphillips 8y agoWouldn’t this be the case for any node app? Why pick on VuePress specifically?
- l_t 8y agoThe OP's comment was specifically with respect to the large number of dependencies, which can increase the "surface area" for this type of attack to happen. And, of course, we're talking about VuePress because this is a thread about VuePress. Similar complains are raised for many other Node libraries, so rest assured that VuePress is not alone in that regard.