2 ms·
Is there a tool that you can put between your npm client and npm web servers that serves package versions that are month old and possibly also tracks discovered
by scotty79 1y ago
Is there a tool that you can put between your npm client and npm web servers that serves package versions that are month old and possibly also tracks discovered malware and never serves infected versions?
- balder1991 1y agoSomething like this? https://jfrog.com/artifactory/ https://jfrog.com/artifactory/
- JackFr 1y agoArtifactory. Nexus. I believe AWS/GCP/Azure have offerings. No bank, and almost no large corporations go directly to artifact/package repos. They all host them internally.
- darthwalsh 1y agoYes, but the public npmjs repository also blocks our corporate IP addresses, so our CI/CD pipelines can't ruin npm for everybody else.
- singulasar 1y agothe company that first found this vulnerability also has a tool for this https://www.npmjs.com/package/@aikidosec/safe-chain https://www.npmjs.com/package/@aikidosec/safe-chain
- lovehashbrowns 1y agoI'm looking at Verdaccio currently, since Artifactory is expensive and I think the CE version still only supports C++. Does anyone have any experience with Verdaccio?
- mikebelanger 1y agoArtifactory works fairly well. Although admittedly, when a user grabs a new dependency, they're downloading from the npmjs registry like anyone else. Really, the killer combo would be to have some kind of LLM-based tool that would scan someone's artifactory. Something smart enough to notice that code changed, and there's code for accessing a crypto-wallet, etc. This would be too expensive for npmjs to host for free, but I could see this happen to hosted artifactory dependencies.