3 ms·
Supply chain attacks are not a JavaScript or npm exclusive risk. If you pull in any dependencies you have a supply chain risk.
by Rohansi 2mo ago
Supply chain attacks are not a JavaScript or npm exclusive risk. If you pull in any dependencies you have a supply chain risk.
- barrkel 2mo agoAs is well known, security is not a binary, it's a spectrum. It's why you add security in layers, and why it's generally a trade-off between risk and usability. Your mileage may vary, but I sleep better with my own projects not having any node_modules in their build tree.