4 ms·
Accidental typos aren't the only way this could be used. You could open a PR that contributes a new feature - all the code looks good, and the feature works as
by lantry 4y ago
Accidental typos aren't the only way this could be used. You could open a PR that contributes a new feature - all the code looks good, and the feature works as expected, but included in the PR is a new malicious dependency that uses deon.land instead of deno.land. That's an easy thing to miss when reviewing a large PR.
- ravenstine 4y agoNPM can specify GitHub URLs as dependencies, so I don't see how this is a problem exclusive to Deno and not Node. Also, this problem can be mitigated by static analysis. No reason why a pre-push hook can't look at all the import identifiers and restrict them to a whitelist of domains. But having mentioned this before in another recent thread about Deno, some people are under the impression that statically analyzing imports is really hard, despite how even a junior engineer could figure it out with an AST parser in a day.
- melvinmelih 4y agoFirst time I saw fontawesome being imported in a PR I had to double check to make sure fortawesome wasn't a typo. npm install @fortawesome/fontawesome-svg-core