4 ms·
The problem with using downloads as a proxy for "safety" is that a bad actor can use CI infra/bots/scripts to inflate the number. This is why in Packj [1] we ch
by ashishbijlani 4y ago
The problem with using downloads as a proxy for "safety" is that a bad actor can use CI infra/bots/scripts to inflate the number. This is why in Packj [1] we check for multiple attributes (e.g., dependents).
1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj
- ok123456 4y agoI just tried this and the output is very very very noisy. It treats any dependent package that hasn't been updated in a while as a "RISK" and it manually tries to resolve each github repository (and runs into API request limits).
- ashishbijlani 4y agoWe've made it highly customizable [1]. For some folks, a package that has not been updated for a while could be classified as abandonware. You can turn off the alerts that do not apply to you by commenting out in .packj.yaml file. We're working on making it similar to email spam. Will post more soon. Meanwhile, we welcome changes that can make it less noisy for the community. [Edit:] one can specify Github API token to get around rate limiting. We'd deeply appreciate if could create an issue for this on the repo. 1. https://github.com/ossillate-inc/packj#customization https://github.com/ossillate-inc/packj#customization