3 ms·
>The first operating system powered by node.js and npm This is interesting, in the light of recent supply chain attacks on npm. How safe is a npm-based OS?
by kgeist 5y ago
>The first operating system powered by node.js and npm
This is interesting, in the light of recent supply chain attacks on npm. How safe is a npm-based OS?
- eins1234 5y agoI'd be curious to learn what kinds of safeguards various package managers of Linux distros have employed against supply chain attacks on individual maintainers who might try to poison certain popular packages if compromised? Specifically, I'd imagine NPM might actually be a bit better than many distro's package repos due to the post left-pad era changes they put in place to make packages more... immutable and tamper-resistant, so the only way for a new malicious package to reach users is for those users to actually explicitly update to the new malicious versions. But being not even remotely familiar with how Linux package repos are updated/maintained, I'm probably missing a lot of nuance.
- brundolf 5y agoSeems feasible to create a limited mirror of NPM with only hand-audited packages (and versions). At that point it's not really different from the repositories managed by OS maintainers.