Questions tagged [npm]
npm is a package manager for Node.js
21
questions
12
votes
3
answers
4k
views
How to vet third-party developer packages
Looking to create a form where developers can submit requests for packages to be installed. We want to create a list of questions that can help us determine whether or not a package is safe. What are ...
- 123
1
vote
1
answer
48
views
Is there a way to check if vulnerability introduced by npm package is reachable/exploitable
I have a problem where I have too many vulnerabilities on a few hundred repositories introduced with outdated npm packages. The issue is that I need to find a way to prioritize this. The biggest pain ...
- 11
0
votes
0
answers
58
views
What is the risk of a known ReDOS Vulnerability in a client side (Browser) app
I'm trying to determine if a client side app, that runs in the browser has any real danger from being vulnerable to a known ReDOS issue.
My understanding of ReDOS is that inefficiencies or known short ...
- 223
6
votes
2
answers
732
views
Are devDependencies in Node.js exploitable?
I am well aware that the best approach is to update any dependency, no matter whether it is a development dependency or a runtime/production dependency.
But from a research prospective, I want to know ...
- 133
3
votes
2
answers
190
views
How much damage can a malicious package do with just "npm install <package>"?
I had a typo and npm installed something that is similar in name to something very popular -- I was concerned about typosquatting. It's quite plausibly legitimate and just a coincidence. I looked at ...
- 31
0
votes
1
answer
222
views
How to prioritize npm dev vulnerabilities? [duplicate]
Running SNYK scanning on my code base I find a number of HIGH vulnerabilities when I include the npm dev dependencies (e.g. running SNYK -dev test --file=package.json).
Examples of vulnerabilities:
...
0
votes
0
answers
129
views
Can I get hold of malicious npm packages?
the npm advisories site lists quite a lot of malicious packages which - in my understanding - are not packages with vulnerabilities but malicious per se. These packages were removed from the npm repo ...
- 161
-1
votes
2
answers
1k
views
Which database is used by npm-audit
you probably know the npm-audit tool which informs you about vulns in your node.js projects dependencies. I'd like to know what database npm-audit is using and how I get access to this data.
Thank ...
- 161
3
votes
2
answers
357
views
How do I get the "vulnerabilities history" of a Node.js package?
When installing a Node.js package via npm or when running npm-audit I get information about known vulnerabilities of packages in the project. From my understanding this means that there must be some ...
- 161
6
votes
1
answer
3k
views
How to deal with prototype pollution attack vulnerability in lodash?
lodash has been reported to be vulnerable to the so called prototype pollution attack in versions up to (excluding) 4.17.5
See https://nvd.nist.gov/vuln/detail/CVE-2018-3721
Now lodash is the most ...
- 163
2
votes
1
answer
146
views
How can the validity and safety of a software library be checked?
So beyond looking at the source code for particular software library, is there a way to vet that it does not contain malicious code? As far as I know from my own research, services like pip, npm, and ...
- 23
1
vote
1
answer
816
views
How secure is WebPack? [closed]
If NPM packages are so vulnerable as described in this article, is it acceptable to use WebPack for web-applications, in which security is a priority?
Edit: when using WebPack you should use NPM-...
- 13
3
votes
2
answers
2k
views
Is it OK to not update devdependencies?
When checking third party libraries used in package.json and build.gradle files with tools such as Snyk, they allow the option to check for devdependencies. A lot of the time there is vulnerabilities ...
- 93
8
votes
3
answers
1k
views
Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?
Recently, eslint-scope and eslint-config-eslint packages were hacked in an interesting way - one of the maintainer's account was compromised by an attacker and a new "patch" version with the malicious ...
- 1,495
2
votes
1
answer
355
views
How is the create-react-app package tree properly sanitized?
React, and it's application creation script, create-react-app, are popular packages nowadays... and with good reason: React is a rock-star framework.
From a security perspective, sanitizing all the ...
- 129
-2
votes
2
answers
147
views
How secure open source packages are? [closed]
When we clone git projects to use as is or when we install free npm packages provided by third party sources, is there any security risk? how trustworthy such packages are for production environment?
5
votes
1
answer
246
views
Malicious NPM Package - Does it fit into OWASP Top Ten 2017?
On various security forums I have seen links to a post about a fictive malicious NPM package harvesting information. The posts title:
I’m harvesting credit card numbers and passwords from your site....
- 665
4
votes
0
answers
116
views
What are commonly used security practices when writing a hybrid mobile app with a framework like ionic 2?
I'm new to hybrid app development and web development in general. Are there common coding practices/techniques I can use to ensure that I write code which does not put the end user at risk of ...
- 141
0
votes
0
answers
107
views
Does `npm install` retrieve binaries or sources?
I am starting to use npm install a lot for development, but I fear about its security consequences. Does npm install retrieve binaries or sources?
If it's binaries, it's already a deal breaker for ...
- 161
6
votes
1
answer
668
views
How do atom's apm and npm verify package integrity?
Are there built in verification methods to make sure the packages contain the correct code? Do they use a hash of some sort?
- 817
16
votes
1
answer
818
views
Unpublished modules on npm: could an attacker take advantage of their former notoriety?
Earlier this week, Azer Koçulu decided to unpublish his modules from npm, the default package manager for Node.js. He had published 273 modules in total.
Some major modules, like Babel and React, ...
- 13.9k