0

If NPM packages are so vulnerable as described in this article, is it acceptable to use WebPack for web-applications, in which security is a priority?

Edit: when using WebPack you should use NPM-packages (with a lot of their dependencies and sub-dependencies), but in "classic" websites you usually download 3rd party libraries from official sites, and update them only when you really need, which seems to be much more secure

  • Could you be more specific? What is the threat you are worried about? How would WebPack influence security? – Sjoerd Dec 18 '18 at 15:38
  • how does webpack (or not) affect the use of bad apples? – dandavis Dec 18 '18 at 18:14
  • I mean that when using WebPack you should use NPM-packages (with a lot of their dependencies and sub-dependencies), but in "classic" websites you usually download 3rd party libraries from official sites, and update them only when you really need – Alex Dec 19 '18 at 8:42
2

The problem is independent of what technique you use to obtain your JS libraries. It doesn't matter if you use NPM packages, web-pack or manually copy&paste a folder of .js files. The problem is with using 3rd party code from untrustworthy sources and putting them into your web application without making sure they don't contain any malicious functionality.

When you decide to use 3rd party libraries in your web application, make sure that:

  • It's a trustworthy project with a good reputation. Is jQuery trustworthy? Is Angular trustworthy? Is PhilippsSuperReliableCreditCardValidator.js trustworthy? Which projects seem trustworthy to you and which don't is a decision you need to make for yourself.
  • You download the files from the official server via an authenticated and encrypted connection (which tool you use for that purpose is secondary)
  • You keep the copies of the libraries on your own server. Don't download libraries from an offsite source on page-load.
| improve this answer | |
  • Worth also adding a note about version pinning if you use a package management system as upstream poisoning and compromise is a real problem. – shellster Dec 19 '18 at 16:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.