8 ms·
Shameless plug: This is what I’m building Socket.dev to solve. Socket watches for changes to “package manifest” files such as package.json, package-lock.json,
by feross 4y ago
Shameless plug: This is what I’m building Socket.dev to solve.
Socket watches for changes to “package manifest” files such as package.json, package-lock.json, and yarn.lock. Whenever a new dependency is added in a pull request, Socket analyzes the package's behavior and leaves a comment if it is a security risk.
You can see some real-world examples here: https://socket.dev/blog/socket-for-github-1.0 https://socket.dev/blog/socket-for-github-1.0
- e1g 4y agoWe use Socket and my favorite feature is when you highlight new dependencies with a post-install hook. It’s not always a problem, but almost always a smell. One feature request: please allow me to “suppress” warnings for a specific package+version combo. This is useful for activist libs that take a political stance - I know it happens, but often cannot remove them, and don’t want to continue flagging the same problem at every sec review.