All Questions
Tagged with npm package-manager
13 questions
1
vote
1
answer
48
views
How can authenticity be ensured for Node.js packages when using a public registry like npmjs.com?
I was thinking about how to ensure the authenticity of Node.js packages that are installed from a public registry like npmjs.com. The only mechanisms (optionally) in place to my understanding are:
...
- 7,075
0
votes
0
answers
69
views
Does Node.js's npm provide cryptographic authentication and integrity validation?
Does Node.js's npm package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them?
I see a lot of guides ...
- 1,098
1
vote
1
answer
132
views
How is the npm package manager made robust security-wise, what are the keys they are using, and how do they use them?
I am specifically looking at the npm package metadata like from the lodash package, the relevant part which is this:
{
"shasum": "392617f69a947e40cec7848d85fcc3dd29d74bc5",
&...
- 694
1
vote
0
answers
585
views
Restrict node.js filesystem access
I have a Node.js app which has a lot of npm-dependencies, running on Linux (Centos) machine.
When Node starts, the script has access to the files outside its directory (as least by default), so ...
- 309
12
votes
3
answers
4k
views
How to vet third-party developer packages
Looking to create a form where developers can submit requests for packages to be installed. We want to create a list of questions that can help us determine whether or not a package is safe. What are ...
- 123
11
votes
2
answers
4k
views
Are devDependencies in Node.js exploitable?
I am well aware that the best approach is to update any dependency, no matter whether it is a development dependency or a runtime/production dependency.
But from a research prospective, I want to know ...
- 183
3
votes
2
answers
415
views
How much damage can a malicious package do with just "npm install <package>"?
I had a typo and npm installed something that is similar in name to something very popular -- I was concerned about typosquatting. It's quite plausibly legitimate and just a coincidence. I looked at ...
- 31
1
vote
1
answer
1k
views
How secure is WebPack? [closed]
If NPM packages are so vulnerable as described in this article, is it acceptable to use WebPack for web-applications, in which security is a priority?
Edit: when using WebPack you should use NPM-...
- 13
3
votes
2
answers
4k
views
Is it OK to not update devdependencies?
When checking third party libraries used in package.json and build.gradle files with tools such as Snyk, they allow the option to check for devdependencies. A lot of the time there is vulnerabilities ...
- 93
8
votes
3
answers
1k
views
Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?
Recently, eslint-scope and eslint-config-eslint packages were hacked in an interesting way - one of the maintainer's account was compromised by an attacker and a new "patch" version with the malicious ...
- 1,625
4
votes
1
answer
286
views
Malicious NPM Package - Does it fit into OWASP Top Ten 2017?
On various security forums I have seen links to a post about a fictive malicious NPM package harvesting information. The posts title:
I’m harvesting credit card numbers and passwords from your site....
- 797
0
votes
0
answers
355
views
Does `npm install` retrieve binaries or sources?
I am starting to use npm install a lot for development, but I fear about its security consequences. Does npm install retrieve binaries or sources?
If it's binaries, it's already a deal breaker for ...
- 161
16
votes
1
answer
949
views
Unpublished modules on npm: could an attacker take advantage of their former notoriety?
Earlier this week, Azer Koçulu decided to unpublish his modules from npm, the default package manager for Node.js. He had published 273 modules in total.
Some major modules, like Babel and React, ...
- 14.7k