4 ms·
Massive attack surface. That's true as a security risk, but also as a dependency risk (eg. left-pad).
by VHRanger 2y ago
Massive attack surface. That's true as a security risk, but also as a dependency risk (eg. left-pad).
- dumbo-octopus 2y agoIf you don’t vendor your dependencies. Which is a poor practice that is commonly associated with NPM, but is by no means a requirement of the technology.
- dumbo-octopus 2y agoEspecially if…, I should say. Even vendored dependencies are a risk as NPM commits the additional sin of allowing the act of pulling a package onto the local machine for inspection to execute arbitrary code in the form of “postinstall” hooks.
- jampekka 2y agoReview and pin your direct dependencies. With transitive dependencies it doesn't differ from trusting large dependencies in general. The alternative to micropackages has significant downsides. Pulling in extra surface and rolling your own buggy implementations while waiting for some commitee to bikeshed years on the implementation. Making the right thing easy rather than the wrong thing hard is a lot better approach.