3 ms·
It looks like only validate the domain isn't enough. NPM does not care about whether the package name in the tarball match to the name in lock or not. So you
by mmis1000 7y ago
It looks like only validate the domain isn't enough.
NPM does not care about whether the package name in the tarball match to the name in lock or not.
So you can just point to tarball path to another package that has the similar name. and nobody with ever notice that.
And domain whitelist won't work in this situaltion either.
- sombremesa 7y agoDoes it care about casing? I doubt it does...so I could for example point ABCmagical to ABCmagicaI. (The last letter in the latter being an uppercase i) You would have to update the package too, or something else to red herring the colorized diff.