3 ms·
npm does something similar with their scoped packages. It fixes the problem for the top level packages, but you'd still have to contend with the transitive depe
by louislang 4y ago
npm does something similar with their scoped packages. It fixes the problem for the top level packages, but you'd still have to contend with the transitive dependencies written by smaller organizations or individual contributors. In this case, you have to guarantee that no one involved in the dependency chain ever typos anything.
- jerpint 4y agoThis is true, and wouldn’t remove the entire space of attack, but would still limit it to some extent.
- louislang 4y agoOh absolutely. Unless everyone wants to be cool and stop publishing malware, gotta take a defense in depth approach here.
- collinmanderson 4y ago"you'd still have to contend with the transitive dependencies written by smaller organizations or individual contributors" - generally these are the higher risk dependencies anyway and should probably be used with extra caution anyway.