3 ms·
Now instead of npm packages abusing SemVer unless you use non-default --save-exact behavior as an attack vector, we can import modules from URLs without subreso
by andrewmcwatters 5y ago
Now instead of npm packages abusing SemVer unless you use non-default --save-exact behavior as an attack vector, we can import modules from URLs without subresource integrity unless you use non-default lock file behavior! Great! We learned nothing!
- Soremwar 5y agoHence why developers always recommend to use immutable sources when importing modules
- andrewmcwatters 5y agoThe web isn't immutable.
- Soremwar 5y ago"Immutable" in the sense that packages can't be taken down or modified by authors If you wanna take it a step further, you can always opt in to that lock file with various degrees of strictness as you yourself mentioned