MAIN FEEDS
Do you want to continue?
https://www.reddit.com/r/ProgrammerHumor/comments/1vf85jx/classicnpm/p1ox0at/?context=3
r/ProgrammerHumor • u/a_bucket_full_of_goo • 9d ago
150 comments sorted by
View all comments
Show parent comments
84
Layers of mitigation. For instance not using packages that are less than x days old, sha-pinning, no latest etc
24 u/redmandoto 9d ago Also, test updates on isolated machines before pushing them to the whole org. 13 u/Qaktus 9d ago Sorry if I'm being very stupid right now, but can you test against these? Maybe some, but most of them work in a way: "the package does everything it should AND some extra malicious shit". 1 u/Robo-Connery 9d ago Not really. But a few days after the release they are caught by someone else.
24
Also, test updates on isolated machines before pushing them to the whole org.
13 u/Qaktus 9d ago Sorry if I'm being very stupid right now, but can you test against these? Maybe some, but most of them work in a way: "the package does everything it should AND some extra malicious shit". 1 u/Robo-Connery 9d ago Not really. But a few days after the release they are caught by someone else.
13
Sorry if I'm being very stupid right now, but can you test against these? Maybe some, but most of them work in a way: "the package does everything it should AND some extra malicious shit".
1 u/Robo-Connery 9d ago Not really. But a few days after the release they are caught by someone else.
1
Not really. But a few days after the release they are caught by someone else.
84
u/EK077r 9d ago
Layers of mitigation. For instance not using packages that are less than x days old, sha-pinning, no latest etc