8 ms·
Nope, because the script was commited to upstream and you can review what ended in the package. It seems a lot of general "wisdom" here is thrown by people who
by littlecranky67 1y ago
Nope, because the script was commited to upstream and you can review what ended in the package.
It seems a lot of general "wisdom" here is thrown by people who have not looked into this particular incident or are unfamiliar with js node dev in general.
- reactordev 1y agoCorrect, luckily, but all it takes is one eval. So be diligent about checking. However, like you said, luckily it’s JavaScript and there’s a history online that you can see. Be weary of binary wasms though, harder to analyze. In the end, because it was published and npm allows you to see the history, we can all see. Still, from a security standpoint, anything within a “package” that is compromised, compromises the package. Don’t install it. Wait for the fix.
- tempaccount420 1y agoWASM should be easier to analyze since you can't look at what functions the WASM imports to do side-effects.