4 ms·
So the audit was mostly about nom the website and the service for maintaining npm packages? That's a good first step. Has there been any talk within the node
by jmspring 13y ago
So the audit was mostly about nom the website and the service for maintaining npm packages? That's a good first step.
Has there been any talk within the node community about auditing node modules themselves? Maybe start with the most popular? I could see this being popular with enterprise development, etc.
I want to say that Strong Loop made noise about doing something like this, but I haven't seen much on it of late.
- daviddias 13y agoOne of the Node Security Project (https://nodesecurity.io/ https://nodesecurity.io/) main efforts is to audit all the npm modules in a community driven way. We are accepting contributions from the community to build the tools that get the job done efficiently and to audit modules, disclosing vulnerabilities in a responsible manner.
- jmspring 13y agoI'll take a look, thanks. Some reviews will, of course, be manual in nature -- implementation correctness of digest auth, for instance, is one that comes to mind (I need to contribute that back to a particular module).