3 ms·

I have an friend that starts an project next month that will rely on npm. He is quite a noob and didn't code in ages. He will have almost no clue how to harden

by Yokohiii 11mo ago

I have an friend that starts an project next month that will rely on npm. He is quite a noob and didn't code in ages. He will have almost no clue how to harden against this, he will probably not even notice if he becomes a victim until something really bad happens. Pretty sad.

mkesper 11mo ago
At least make them run pnpm instead of npm, disabling post-install scripts. https://pnpm.io/supply-chain-security https://pnpm.io/supply-chain-security
newsoftheday 11mo ago
"a friend" because friend starts with a consonant sound, not a vowel sound. "a project" for the same reason. HTH.
- Yokohiii 11mo ago
  Like an egregious comment?