2 ms·
To avoid LeftPad 3.0 they're going to have to add some sort of signed capabilities manifest to restrict API access for these narrow domain packages. Then attack
by kevin_thibedeau 1y ago
To avoid LeftPad 3.0 they're going to have to add some sort of signed capabilities manifest to restrict API access for these narrow domain packages. Then attackers would limited to targeting those with network privileges.
- lrvick 1y agoPackage signing of any kind was ruled out in 2013 for nonsensical reasons https://github.com/npm/npm/pull/4016 https://github.com/npm/npm/pull/4016
- thunderfork 1y ago[dead]
- ____tom____ 1y agoTime to revisit, clearly.
- tmpfs 1y agoAgreed, more than time to revisit. I have stopped using npm entirely because of their cavalier attitude to security. Code signing could and should have been implemented years ago. It's not a panacea but just part of defense in depth. I can't trust npm whatsoever to do the right thing at this point.