3 ms·
No they could not. Because your package-lock.json contains integrity hashes that are verified during installation.
by felixfbecker 5y ago
No they could not. Because your package-lock.json contains integrity hashes that are verified during installation.
- Soremwar 5y agoOnly if you update dependencies, a fresh install would not have such integrity checks, so it's just as vulnerable as Deno hosts to such attacks