5 ms·

> Because as the package owner I _do_ have that context. I understand there may be significant issues with this approach though! But what if one of your contri

> Because as the package owner I _do_ have that context. I understand there may be significant issues with this approach though! But what if one of your contributors slips in a merge that uses the vulnerable code path of your dependency... Does this "not affected" marker still exist, and now you have vulnerable code? Does it disappear with each version? What if someone maliciously adds a "not affected" marker? To a package they intend to exploit? Edit: Again why the heck am I being downvoted?

TheDong 5y ago
> what if one of your contributors slips in a merge that uses the vulnerable code path of your dependency If your threat model is a contributor submitting malicious code, your problem is not something npm audit will help with either way. If a malicious actor is able to add the "not affected" marker, you have bigger problems. The threat model you're talking about neither seems realistic, nor like something npm audit can help with. The attack vector of a contributor sneaking in malicious code is dealt with by only giving the commit bit to trusted people, and reviewing code yourself.
- cphoover 5y ago
  > The threat model you're talking about neither seems realistic, nor like something npm audit can help with. The attack vector of a contributor sneaking in malicious code is dealt with by only giving the commit bit to trusted people, and reviewing code yourself. How is this not realistic when it has already been seen in the npm ecosystem multiple times. For an example of this in the wild see the event-stream (crypto-mining trojan) fiasco: https://github.com/dominictarr/event-stream/issues/116 https://github.com/dominictarr/event-stream/issues/116 Dependencies are a target for exploit, your package may be safe now and then become unsafe in the future, either intentionally or unintentionally.
  - enumjorge 5y ago
    The problem is, if a security vulnerability snaked past the maintainers of a project, what hope do I have as someone who consumes the package to a) catch it b) know how to fix it?
    - cphoover 5y ago
      That's exactly the issue that npm-audit seeks to ameliorate. It's not perfect, but it's better than nothing.

TheDong 5y ago

> what if one of your contributors slips in a merge that uses the vulnerable code path of your dependency If your threat model is a contributor submitting malicious code, your problem is not something npm audit will help with either way. If a malicious actor is able to add the "not affected" marker, you have bigger problems. The threat model you're talking about neither seems realistic, nor like something npm audit can help with. The attack vector of a contributor sneaking in malicious code is dealt with by only giving the commit bit to trusted people, and reviewing code yourself.

cphoover 5y ago
> The threat model you're talking about neither seems realistic, nor like something npm audit can help with. The attack vector of a contributor sneaking in malicious code is dealt with by only giving the commit bit to trusted people, and reviewing code yourself. How is this not realistic when it has already been seen in the npm ecosystem multiple times. For an example of this in the wild see the event-stream (crypto-mining trojan) fiasco: https://github.com/dominictarr/event-stream/issues/116 https://github.com/dominictarr/event-stream/issues/116 Dependencies are a target for exploit, your package may be safe now and then become unsafe in the future, either intentionally or unintentionally.
- enumjorge 5y ago
  The problem is, if a security vulnerability snaked past the maintainers of a project, what hope do I have as someone who consumes the package to a) catch it b) know how to fix it?
  - cphoover 5y ago
    That's exactly the issue that npm-audit seeks to ameliorate. It's not perfect, but it's better than nothing.