3 ms·
Well, how do you know it's "just" a mirror service, and it is not using a zero-day to exploit your system, by installing a root-kit or copying your code to thei
by warpech 7y ago
Well, how do you know it's "just" a mirror service, and it is not using a zero-day to exploit your system, by installing a root-kit or copying your code to their servers?
I agree that it's a valid concern.
- lqs469 7y agoIn fact, you can compare the installed dependencies code line by line, Javascript won't be compiled anyway.
- gpmcadam 7y agoIf you're concerned about injection into a third-party package, you should be using `package-lock.json` (or equiv) and integrity hashing your dependencies at install time.
- wp381640 7y agosigned packages would go some way towards better distributing npm