Hot answers tagged

43 votes
Accepted

How to vet third-party developer packages

I highly doubt that a process to request approvals for new third-party packages will have the desired effects. I've worked for organizations that have tried to introduce similar processes, and they ...
  • 1,022
11 votes
Accepted

Unpublished modules on npm: could an attacker take advantage of their former notoriety?

Could malicious code be pushed to NPM? Most certainly. If a package is to become compromised (or a new one is published), installed, and used any code provided with that package could be executed. So ...
  • 3,340
6 votes

Are devDependencies in Node.js exploitable?

It depends on the vulnerability, and on the threat environment (as is true for every component, not just development ones). Here are a few (generic) examples: A tool that fetches an external script ...
  • 40.3k
4 votes
Accepted

Are devDependencies in Node.js exploitable?

While running the npm start command and the dev env set to development or running a special command (like npm run dev, where dev is a special script which starts up a local development environment as ...
4 votes

Is it OK to not update devdependencies?

That depends on what the dependencies are and what they're used for. Even if a dependency isn't used in production, if it's used as part of your build process, for example, then its possible that it ...
  • 4,637
4 votes
Accepted

Is it OK to not update devdependencies?

They matter. Not updating libraries and dependencies will leave your software vulnerable. Each one of the libraries is part of the attack surface. Unless an update breaks your code, update as soon as ...
  • 50.7k
4 votes
Accepted

Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?

Three words: Supply Chain Management. Except that in our case the "supply" is dependency or "third party libraries". This isn't a unique problem to npm. This a general problem in software ...
  • 555
3 votes
Accepted

How can the validity and safety of a software library be checked?

You have basically two options (provided you can verify your download, e.g., using a PGP signature): Read the code yourself Find some way to trust the developer Reading the code yourself will not ...
  • 3,233
2 votes

Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?

Basically the issue here is that 3rd party software tried to steal private information and send it out over the network. This issue is not unique to npm, any software running as your computer users ...
2 votes

Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?

Supply chain management is the right answer in theory, however, despite the efforts of commercial entities like snyk and many others, there is no solution to this problem in the node ecosystem in ...
  • 3,359
2 votes

How secure open source packages are?

Especially on npm there were known active attacks. The package cross-env was useful and used by many users, but the package crossenv would leak all your environment variables to another host. ...
  • 28.7k
2 votes

How secure open source packages are?

Of course there is a risk. Floss software doesn't eliminate malware, it just makes recognizing it possible. For a well-known big project, there will be some people looking at the code all the times,...
2 votes
Accepted

How secure is WebPack?

The problem is independent of what technique you use to obtain your JS libraries. It doesn't matter if you use NPM packages, web-pack or manually copy&paste a folder of .js files. The problem is ...
  • 48.9k
2 votes
Accepted

How to securely use `pass`, `sudo`, and `npm` on the same machine

running npm i ... not long after pass my-password allows a malicious package to steal my entire password store Yes, but not just that. Running npm i ... at any time before pass my-password allows a ...
1 vote

How does npm’s ECDSA signing system improve security?

NPM's signatures allow you to check that when you have a copy of the package, that it has the same contents as the package in the NPM registry. Thus, you can prove that a downloaded copy was not ...
  • 1,068
1 vote

Is there a way to check if vulnerability introduced by npm package is reachable/exploitable

The standard approach to prioritize vulnerability management is to focus on severity level. You should focus on Critical vulnerabilities first,then High etc. As suggested by Robert, it's not practical ...
1 vote

How much damage can a malicious package do with just "npm install <package>"?

Conceptually, installing a package permits running setup scripts which in turn could be leveraged to execute arbitrary code on the system under the privileges of the executing user (hope it wasn't ...
  • 3,911
1 vote

Which database is used by npm-audit

As of Oct 7 2021, npm audit relies on GitHub Advisory Database: GitHub Advisory Database now powers npm audit.
1 vote
Accepted

How do I get the "vulnerabilities history" of a Node.js package?

You might want to take a look at https://snyk.io. It has a public Vulnerability DB including many npm packages. There you can search for your desired packages to get all known vulnerabilities. For ...
1 vote

How do I get the "vulnerabilities history" of a Node.js package?

If you are searching for vulnerabilites in packages and software I would suggest to look in databases like https://cve.mitre.org/. There are all common vulnerabilities and exposures listed you are ...
  • 628
1 vote

How is the create-react-app package tree properly sanitized?

You can use https://snyk.io/ scanner. The dependencies of applications like react are really complex. There are same packages in multiple versions used. Also, such projects when they evolve they add ...
  • 2,706
1 vote

Malicious NPM Package - Does it fit into OWASP Top Ten 2017?

It seems clear to me that a maliciously coded library is perfectly covered by A9:2017-Using Components with Known Vulnerabilities. I thought that A9 was created for this very use case. Although the ...
  • 124k
1 vote
Accepted

How do atom's apm and npm verify package integrity?

According to npm issue #6886, there is a system for validating the contents of packages via any checksum or hashing system. Quote from GitHub user othiym23: npm has included validation of the ...

Only top scored, non community-wiki answers of a minimum length are eligible