3 ms·
I'm confused, how would this prevent supply chain attacks? Wouldn't you need to sandbox node itself, instead of npm?
by agucova 3y ago
I'm confused, how would this prevent supply chain attacks? Wouldn't you need to sandbox node itself, instead of npm?
- lapinot 3y agoIt does not, supply chain attack is not that afaik. This is to defend against npm executing arbitrary nefarious code as your user on install of a compromised package. Also sandoxing npm really means sandboxing node running npm (which is js).
- jchw 3y agoMy understanding: It's sandboxing to protect against exploits delivered via supply chain attacks, which often use low hanging fruit like hooks on install to steal tokens/etc. It's definitely not perfect, but it does not hurt either.