3 ms·

> In theory the same things could happen for PIP, Maven, Gradle, their Rust and Go counterpart and any such package manager. Any data on this? Supply chain att

> In theory the same things could happen for PIP, Maven, Gradle, their Rust and Go counterpart and any such package manager. Any data on this? Supply chain attacks, such as these, can definitely happen to any language. NPM seems to be a nice target simply because the volume of deps your avg 'simple' node project has (I mean, 'npm generate'ing a simple strapi-backed static site for us and there's ~300mb of node_modules...). There's not really a cure. You can peg your deps to a version, but with that much code in there, you're never going to really know if that version is compromised. If you can come up with a solution, there's money to be made.. Edit: The best we really have atm is just scanning for known vulns with stuff like xray/lifecycle/dependabot. Better than nothing, but for sure there are malicious packages out there yet to be discovered.

potta_coffee 5y ago
It can be a problem in any language or package manager but in my Golang project, I have a single dependency outside of the standard library, in my Javascript project I conservatively have 200+ (if I consider all the packages installed by my primary dependencies). The surface area is just that much bigger and the packages change so frequently.
- cyberpunk 5y ago
  So you recon a better (bigger?) node stdlib would solve a lot of this?
  - ocdtrekkie 5y ago
    Probably, yes. I'd say most mature tech stacks provide most of what you are likely to need first party. .NET is an incredible ecosystem for this: Nearly everything the standard developer needs is available from Microsoft, most common third party packages you might want to pull in were authored by an enterprise company with support available, and if you're pulling in something by an individual, it's probably pretty niche.
  - merrywhether 5y ago
    That Golang project also likely isn’t trying to be a highly interactive UI running on thousands of different runtime configurations.
deleted 5y ago
[deleted]

potta_coffee 5y ago

It can be a problem in any language or package manager but in my Golang project, I have a single dependency outside of the standard library, in my Javascript project I conservatively have 200+ (if I consider all the packages installed by my primary dependencies). The surface area is just that much bigger and the packages change so frequently.

cyberpunk 5y ago
So you recon a better (bigger?) node stdlib would solve a lot of this?
- ocdtrekkie 5y ago
  Probably, yes. I'd say most mature tech stacks provide most of what you are likely to need first party. .NET is an incredible ecosystem for this: Nearly everything the standard developer needs is available from Microsoft, most common third party packages you might want to pull in were authored by an enterprise company with support available, and if you're pulling in something by an individual, it's probably pretty niche.
- merrywhether 5y ago
  That Golang project also likely isn’t trying to be a highly interactive UI running on thousands of different runtime configurations.

deleted 5y ago

[deleted]