4 ms·

Not in jest. Still using node_modules from before these stunts started to occur. I recognize I am accepting risk. What I am avoiding is the surprise of a ^versi

Not in jest. Still using node_modules from before these stunts started to occur. I recognize I am accepting risk. What I am avoiding is the surprise of a ^version-compatible file introducing new and unwanted “features”.

pabs3 4y ago
What do you do for security updates? There are a lot of them for NPM modules. Seems GitHub manages the database for those now: https://github.com/advisories https://github.com/advisories
- ficklepickle 4y ago
  I swear 99% of them are prototype pollution or regex DOS that don't apply to how I'm using the dependency.
  - 0des 4y ago
    See, now I can only assume you are playing with our emotions. You got the forehead vein going at first though so I'll give you that.
  - pabs3 4y ago
    What about the 1% that delete data or allow for code execution?
- CodeWriter23 4y ago
  Snapshot VM, npm install
  - pabs3 4y ago
    And how do you know that is safe and hasn't exfiltrated all your data or used a VM escape exploit.
0des 4y ago
Even then, if undocumented functionality is waiting for a certain day or certain action for something to execute you have no way in asserting one way or the other if it is safe because you haven't reviewed it.