4 ms·

Downloading binaries as part of an installation of a scripting language library should always be assumed to be malicious. Everything must be provided as source

• oulipo2 1y ago
  Sure, but then you need to have a way to whitelist
  • lrvick 1y ago
    The whitelist is the package-lock.json of the hashes of libraries you or a security reviewer you trust has reviewed.