To what extent should one trust web/js frameworks?

Most frameworks are open source - developed in the open. Hence, many people can semi anonymously commit to the project. Human validation might be tricked and an attacker is able to commit some "harmful" code that then gets unintentionally called by the web programmer, who uses only the most abstract API layer.

How realistic is such a scenario? And how harmful could such code be?

Furthermore, Angular and React were initiated by Google and Facebook and have a strict revision process. I am now looking at framework developed by Alibaba and (for the most part) the Chinese open source community.

Considering the somewhat bad reputation of Chinese IT products, is there more reason to be concerned? or is this just something that the media/politicians push?

  • Have you heard about Apache Struts? struts.apache.org The harm can be massive. Are you really asking about intentional malicious code in frameworks?
    – schroeder
    Jul 11, 2018 at 21:56
  • 2
    Related story (fictitious but scarily believable). Jul 12, 2018 at 14:12

3 Answers 3


My personal opinion- web/js projects are generally not trustworthy, as the ecosystem is exceptionally weak when it comes to supply chain security. That said, I would not be unusually concerned about a large Alibaba-produced open source library in wide use. I would be more concerned about small node projects deeply enmeshed in the dependency graph.

Concerns about Chinese IT are in products in which visibility, much less security analysis, into the end product or production process is significantly more difficult than in open source- areas like chips, hardware, and algorithms.


It is highly unlikely to happen in popular projects though it is possible.

As Siddharth pointed out in his answer the core contributors and reviewers will analyze the code before merging the pull request. Even if it passes the review and gets merged there is a time frame before it is released to the public.

Most of the popular frameworks have a release schedule. They do not merge change today and release it tomorrow. It is highly likely that any security loophole will remain unnoticed during this timespan.


The scenario you mentioned is certainly possible but is highly unlikely in any big/serious open source project or projects backed by good organisations. Its true that skilled contributor can include some malicious code into his PR but it is the responsibility of the core contributor/reviewers to analyse it thoroughly before merging. Having a well structured release process with nightly build beta testing helps a lot.

But yeah you can never be sure and that's why enterprises tend to avoid a lot of open source stuff. They just use the ones that are very established or backed by a corporation.

Update: Recent example https://github.com/eslint/eslint-scope/issues/39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .