4 ms·
Why is a security tool used for checking package security shipped as a browser extension which have historically been pretty bad with security and permissions.
by hahn-kev 3y ago
Why is a security tool used for checking package security shipped as a browser extension which have historically been pretty bad with security and permissions. Sorry but I don't want to install this when a website could do the exact same thing. Make a bookmarklet if you want it to be easy to use.
- feross 3y agoThere is a website here https://socket.dev https://socket.dev where you can search for any OSS package and get the same information without the need for an extension. The idea behind the extension is that it integrates directly into the developer workflow so you don’t have to remember to check a separate website.
- ermir 3y agoWhat would really integrate with the developer workflow would be some kind of npm command that can check the package.json or the lock file and generate instant output on the console. You can then have whitelists, integration with CI/CD, and lots of other neat stuff.
- feross 3y agoWe have that too :) https://docs.socket.dev/docs/socket-cli https://docs.socket.dev/docs/socket-cli