2 ms·
You can mitigate against those kinds of attacks using npm's `--before` option: npm i --before=`date -I -d '-5 days'` It will only install packages releas
by stagas 5y ago
You can mitigate against those kinds of attacks using npm's `--before` option:
npm i --before=`date -I -d '-5 days'`
It will only install packages released before the specified date.
- samhw 5y agoI think this is engendering a false sense of security. NPM's awful documentation doesn't specify whether it's possible for a dependency published 1 year ago to install, via a wildcard [transitive] dependency, a dependency updated today[0]. I have absolutely zero faith in the NPM devs' having considered this. [0] In fact, it doesn't specify this flag at all. Nor does the command line help, or man page. It doesn't say a word about this, and it appears the only way to determine the semantics of this flag is to run it.