the npm advisories site lists quite a lot of malicious packages which - in my understanding - are not packages with vulnerabilities but malicious per se. These packages were removed from the npm repo for good reason, but is there a possibility to get hold of these packages without being an AV-Company?

  • 2
    Try GitHub? Most NPM packages are open-source. – Fund Monica's Lawsuit Jul 22 '19 at 20:52
  • Malicious and/or vulnerable packages are contained within that repository. – multithr3at3d Jul 22 '19 at 22:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.