4 ms·
Great writeup by Liran, he's also a member of the Node.js security team and I recommend checking his talks about package ecosystem security.
by inglor 8y ago
Great writeup by Liran, he's also a member of the Node.js security team and I recommend checking his talks about package ecosystem security.
- thibaut_barrere 8y agoUltimately, I hope we end up getting (in some future) some form of "cross language" global network of versions & vulnerabilities signaling, with e.g. alerts when you install something, or at runtime, and push notifications for all "subscribers" (outside of a paid product).
- tannhaeuser 8y agoOWASP [1] maintains npm, maven (and nuget, I believe) plugins for detecting use of packages with known vulnerabilities, and a vulnerability db, of course. [1]: https://www.owasp.org/ https://www.owasp.org/
- the_duke 8y agoTalk here: https://vimeo.com/274629722 https://vimeo.com/274629722