3

We deal with a lot of customer information including name, address, SSNs, etc. are we are using a new setup with Full admin machines that have access to the databases where the information is stored.

We need a way to tell if packages installed via Visual Studios Nuget Package Manager is safe to use on confidential customer information.

From what I know, is that anybody can contribute to Nuget and could possibly introduce malicious code.

Is there an trusted and well known institution/source that verifies Nuget Packages as safe, or is there a vetting process that companies can go through to ensure the safety of these packages without looking through the entire source code??

1
  • might be a bug too, not something malicious. leftpad also comes to mind. get what you pay for i guess... – dandavis Dec 16 '17 at 11:06
2

anybody can contribute to Nuget and could possibly introduce malicious code.

Anybody can contribute new packages. Only the owners of an existing package can modify it.

Is there an trusted and well known institution/source that verifies Nuget Packages as safe

Not as far as I am aware

is there a vetting process that companies can go through to ensure the safety of these packages without looking through the entire source code??

First of all vet the package maintainer - in the same way you would your requested "institution/source that verifies Nuget Packages as safe". If you trust the body behind the package then you can extend that to something under their control. Make sure to apply the same process to any dependencies!

If you cannot trust the package author then you have to audit the code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.