4 ms·
I’m really wondering how 1P is able to audit the NPM dependency tree on every build.
by moltar 4y ago
I’m really wondering how 1P is able to audit the NPM dependency tree on every build.
- whydid 4y agoProbably with a local gated mirror, and very careful upgrades. I hope...
- krainboltgreene 4y agoYou know you can lock dependencies, right?
- moltar 4y agoI know of course. But you still need to audit them before. And then on every npm update you do. It can be a full time job. But even then there’s no guarantee you’ll slip and miss. I can definitely see a potential targeted attack. Since you could reverse the 1P bundle and see what packages it uses and then try to insert some malicious code. And then gain access to millions of 1P vaults.