3 ms·
If there's a vulnerability in Webpack (a devDependency) that injects malicious code into your bundle, `npm prune --production` won't save you.
by Vinnl 5y ago
If there's a vulnerability in Webpack (a devDependency) that injects malicious code into your bundle, `npm prune --production` won't save you.
- remram 5y agoThis is not a vulnerability (ie. security bug) it's an attack (ie. malicious).
- Vinnl 5y agoIt doesn't really matter how you call it; the problem is that there could be CVE's in your devDependencies that affect your production build, and pruning those dependencies after using them to create that build doesn't remove the risk.