4 ms·
> In npm we at least know that a package is immutable once published, someone could publish a malicious version as a newer release but a current release. This
by dkdbejwi383 6y ago
> In npm we at least know that a package is immutable once published, someone could publish a malicious version as a newer release but a current release.
This is only true as long as you trust NPM. If they were hacked or taken over by a malicious actor, packages could be modified unbeknownst to you.
- felixfbecker 6y agoNo they could not. Because your package-lock.json contains integrity hashes that are verified during installation.
- Soremwar 6y agoOnly if you update dependencies, a fresh install would not have such integrity checks, so it's just as vulnerable as Deno hosts to such attacks