3 ms·
I think in large part is there’s a higher focus on modularization in Node.JS which leads to lots more dependencies. That increases the attack vector and makes a
by extheat 5y ago
I think in large part is there’s a higher focus on modularization in Node.JS which leads to lots more dependencies. That increases the attack vector and makes a supply chain attack easy because all it takes is a single malicious author to break trust in a chain of hundreds of packages. For example a code base I work on currently has over 250+ 3P dependencies, not because we import that many deps but because the dep tree expands that far. Combine that with copycat attacks, where one person does one thing and others feel motivated to push their button, it exasperates the problem.