2 ms·

Can anyone using the NPM ecosystem actually control their supply chain? Personally, I feel that anyone using JavaScript doesn’t care about such things. Becaus

• wslh 3y ago
  There is another ongoing thread in HN here: https://news.ycombinator.com/item?id=38641211 https://news.ycombinator.com/item?id=38641211 with extra feedback.
• earthboundkid 3y ago
  I mean, I use NPM, but I'm making a small traffic news site with no APT enemies. If you're making a wallet and think "Yes, auto-updating dependencies sounds like a good idea," maybe you're not very good at security?
• TomaszZielinski 3y ago
  You can make things a bit better immediately by installing on outbound firewall like Little Snitch or Open Snitch. And then if you install a malicious package that phones home, you might get an alert. Of course this doesn't guarantee anything, as the package might activate the malicious behavior only under some specific circumstances. But it also doesn't cost anything. So it's a small win in my book. Here's how it works in practice: https://askubuntu.com/questions/1145649/apt-strange-requests-to-d16r8ew072anqo-cloudfront-net80 https://askubuntu.com/questions/1145649/apt-strange-requests... --note this part in the accepted answer: > they are surprised that more people hadn't noticed the behavior in the past.