3 ms·
I compiled a list of NPM best practices one can adopt to reduce supply chain attack risks (even if there's no perfect security preventions, _always_): https://g
by bodash 11mo ago
I compiled a list of NPM best practices one can adopt to reduce supply chain attack risks (even if there's no perfect security preventions, _always_): https://github.com/bodadotsh/npm-security-best-practices https://github.com/bodadotsh/npm-security-best-practices
Discussion on HN last time: https://news.ycombinator.com/item?id=45326754 https://news.ycombinator.com/item?id=45326754
- giantg2 11mo agoDo you know of anything similar for pip?
- bodash 11mo agoMost of the best practices can be translated to python ecosystem. It’s not exact 1:1 mapping but change few key terms and tools, the underlying practices should be the same. Or copy that repo’s markdown into an llm and ask it to map to the pip ecosystem
- giantg2 11mo agoYeah, was mostly interested in the tooling.
- kernc 11mo agoNo.1: Run untrusted code in a sandbox! https://github.com/sandbox-utils/sandbox-venv https://github.com/sandbox-utils/sandbox-venv
- herpdyderp 11mo agoFor anyone publishing packages for others to use: please don't pin exact dependency versions. Doing so requires all your users to set "overrides" in their own package.json when your dependencies have vulnerabilities.
- btbuildem 11mo agoI have a shorter list of NPM best practices: 1. Don't