3 ms·
The supply chain attacks you need to worry about come from using npm.
by cpburns2009 3mo ago
The supply chain attacks you need to worry about come from using npm.
- Rohansi 3mo agoNo, it's not specifically npm. All package managers enable remote code execution by design - you tell it to download code and then you run that code, likely without sandboxing, by using it. Most people are not inspecting the code before they download and run it. You will still see compromised packages making their way through npm even though they disabled install scripts.
- cpburns2009 3mo agoI agree. I just pointed out npm because it's the most prominent javascript one.