4 ms·

You might have been "pwned" in the meantime waiting for 7 days! If I'm checking, I have to check everything no? That's just updating every dependency! Am I ta

You might have been "pwned" in the meantime waiting for 7 days! If I'm checking, I have to check everything no? That's just updating every dependency! Am I taking crazy pills? Obviously cooldowns don't work.

rcxdude 5mo ago
If you install a package that has been part of a supply chain attack, you definitely have a problem. If you have a dependency with a vulnerability, you might have a problem, and any really bad one you are likely to find out about anyway. You can also subscribe to notifications for CVEs as well. Obviously, you would ideally be reviewing every update to every dependency manually, and reviewing them for security problems as well, but in the absence of the resources to do that, the risk balance for cooldowns makes a decent amount of sense (especially since the number of high-profile everyone-patch-now vulnerabilities in the npm ecosystem is now a fair bit smaller than the number of supply chain attacks).
dns_snek 5mo ago
Do you update your dependencies and push to production every single day? Saturdays and sundays too? What are the chances that your code is using a vulnerable dependency AND doing so in an exploitable manner AND the vulnerability being serious enough to warrant immediate attention? The likelihood of that is extremely low unless you're high-profile enough to have a team dedicated to this. 99.9% of vulnerabilities in your dependencies aren't actually exploitable in your project. Most exploitable vulnerabilities probably aren't that serious. And even if it's serious, it's unlikely that you would be targeted immediately. On the other hand you have a constant stream of unreviewed dependency updates, each one having a small chance of containing malicious code. The most pragmatic approach, IMO, is to set up alerts for high severity CVEs, cooldown of at least 24h, and only execute code in per-project sandboxes (VMs or containers). 1 day is short enough that it would practically never be a problem, regardless of severity. It's historically been long enough to discover the vast majority of these supply chain attacks, and alerting for high severity CVEs is something you should be doing anyway if you're worried about security.

rcxdude 5mo ago

If you install a package that has been part of a supply chain attack, you definitely have a problem. If you have a dependency with a vulnerability, you might have a problem, and any really bad one you are likely to find out about anyway. You can also subscribe to notifications for CVEs as well. Obviously, you would ideally be reviewing every update to every dependency manually, and reviewing them for security problems as well, but in the absence of the resources to do that, the risk balance for cooldowns makes a decent amount of sense (especially since the number of high-profile everyone-patch-now vulnerabilities in the npm ecosystem is now a fair bit smaller than the number of supply chain attacks).

dns_snek 5mo ago

Do you update your dependencies and push to production every single day? Saturdays and sundays too? What are the chances that your code is using a vulnerable dependency AND doing so in an exploitable manner AND the vulnerability being serious enough to warrant immediate attention? The likelihood of that is extremely low unless you're high-profile enough to have a team dedicated to this. 99.9% of vulnerabilities in your dependencies aren't actually exploitable in your project. Most exploitable vulnerabilities probably aren't that serious. And even if it's serious, it's unlikely that you would be targeted immediately. On the other hand you have a constant stream of unreviewed dependency updates, each one having a small chance of containing malicious code. The most pragmatic approach, IMO, is to set up alerts for high severity CVEs, cooldown of at least 24h, and only execute code in per-project sandboxes (VMs or containers). 1 day is short enough that it would practically never be a problem, regardless of severity. It's historically been long enough to discover the vast majority of these supply chain attacks, and alerting for high severity CVEs is something you should be doing anyway if you're worried about security.