5 ms·
Worst case is more along the lines of a bad actor makes malicious changes to the dependency which you then unwittingly deploy to prod potentially compromising y
by jeremycw 8y ago
Worst case is more along the lines of a bad actor makes malicious changes to the dependency which you then unwittingly deploy to prod potentially compromising your entire system.
- riyakhanna1983 8y agoI wonder if the detection of such cases be automated.
- TeMPOraL 8y agoJust pin the versions of all your dependencies, and never deploy updated versions without manual review.
- riyakhanna1983 8y agoBut how to know if the pinned versions are free of malicious code from an evil contributor?
- cortesoft 8y agoOr if the dependency disappears and breaks deploys https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/ https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/
- Nasrudith 8y agoReally I couldn't help but facepalm when I heard about that. "Haven't those people heard of local caching?!" Really and also freeze the version number to what you know will work while you are at it. Unless it is an actual security and/or standardization important component (say SSH) it can wait until you know what it will do and that it won't break anything. It is good for bloat avoidance, security, and reliability.