3 ms·
Nice disclosure, and can't fault the npmjs team given that they commissioned a security audit as soon as they possibly could. I wonder if the npm, Inc. team to
by cjbprime 13y ago
Nice disclosure, and can't fault the npmjs team given that they commissioned a security audit as soon as they possibly could.
I wonder if the npm, Inc. team told ^Lift about the disclosed vulns before ^Lift's own audit completed. I can imagine being tempted to see whether they'd discover it themselves, to gain more evidence on how comprehensive the audit was.
- seldo 13y agoWe told them as soon as we found out, because we needed them to go looking for the same hole in all of our code bases :-) As part of the audit, ^Lift audited a lot of the third-party modules we use, and notified the authors of those packages separately (I'm not aware of the details, but I don't think there was anything major).