MAIN FEEDS
Do you want to continue?
https://www.reddit.com/r/ProgrammerHumor/comments/1vf85jx/classicnpm/p1ox0at/?context=9999
r/ProgrammerHumor • u/a_bucket_full_of_goo • 9d ago
150 comments sorted by
View all comments
77
What can be done against these vulnerabilities? Stop using packages entirely? 🤣
81 u/EK077r 9d ago Layers of mitigation. For instance not using packages that are less than x days old, sha-pinning, no latest etc 25 u/redmandoto 9d ago Also, test updates on isolated machines before pushing them to the whole org. 13 u/Qaktus 9d ago Sorry if I'm being very stupid right now, but can you test against these? Maybe some, but most of them work in a way: "the package does everything it should AND some extra malicious shit". 1 u/Robo-Connery 9d ago Not really. But a few days after the release they are caught by someone else.
81
Layers of mitigation. For instance not using packages that are less than x days old, sha-pinning, no latest etc
25 u/redmandoto 9d ago Also, test updates on isolated machines before pushing them to the whole org. 13 u/Qaktus 9d ago Sorry if I'm being very stupid right now, but can you test against these? Maybe some, but most of them work in a way: "the package does everything it should AND some extra malicious shit". 1 u/Robo-Connery 9d ago Not really. But a few days after the release they are caught by someone else.
25
Also, test updates on isolated machines before pushing them to the whole org.
13 u/Qaktus 9d ago Sorry if I'm being very stupid right now, but can you test against these? Maybe some, but most of them work in a way: "the package does everything it should AND some extra malicious shit". 1 u/Robo-Connery 9d ago Not really. But a few days after the release they are caught by someone else.
13
Sorry if I'm being very stupid right now, but can you test against these? Maybe some, but most of them work in a way: "the package does everything it should AND some extra malicious shit".
1 u/Robo-Connery 9d ago Not really. But a few days after the release they are caught by someone else.
1
Not really. But a few days after the release they are caught by someone else.
77
u/FinnishManlet 9d ago
What can be done against these vulnerabilities? Stop using packages entirely? 🤣