4 ms·
What makes npm more insecure than other packaging systems?
by Kiro 5y ago
What makes npm more insecure than other packaging systems?
- jacques_chester 5y agoI would say that it's not that different from others I've seen, just more visible because of the size and activity of the repository. One thing NPM does (and I believe Python too) is to allow install scripts -- this has been a reliable vector for attackers to steal credentials. Not every package repository system has that.
- avereveard 5y agoauthors cannot revoke their compromised keys to immediately halt all distribution, and you don't have any process to verify package<->author ownership beyond the upload secrets.