4 ms·

Is there a way to get stats on suspicious activity on NPM repos? I feel like this is a service that every node.js project is in need of after left-pad and now t

by cellis 8y ago

Is there a way to get stats on suspicious activity on NPM repos? I feel like this is a service that every node.js project is in need of after left-pad and now this.

kofejnik 8y ago
check them into your git
- dmortin 8y ago
  How does that help? You still update from time to time get fixes, new features and then you can get some unwanted code which is not discovered yet.
  - kofejnik 8y ago
    it enables you to run git diff after updating your npm dependencies, so you at least have a chance to detect something shady
    - bbody 8y ago
      In this situation, wouldn't it tell you the package had a version bump?
- gedy 8y ago
  and/or use fixed versions with package-lock. Or private npm cache if you are concerned.
cellis 8y ago
Edit: Applies to any package manager, e.g. ruby gems, elixir hex packages, Python eggs.
bbody 8y ago
You could run NPM Audit (https://docs.npmjs.com/cli/audit https://docs.npmjs.com/cli/audit)
- cellis 8y ago
  But this wouldn’t catch issues with pushing immediately after being granted access, new github accounts pushing changes to libs with thousands of dependents, libs whose dependencies were yanked from npm. Only published vulnerabilities, right?
  - bbody 8y ago
    My apologies, I assumed you meant ones with known vulnerabilities. Given OP's link that was a bad assumption to make.
iforgotpassword 8y ago
Don't forget getcookies backdoor: https://blog.npmjs.org/post/173526807575/reported-malicious-module-getcookies https://blog.npmjs.org/post/173526807575/reported-malicious-...