New answers tagged

1 vote

How does npm’s ECDSA signing system improve security?

NPM's signatures allow you to check that when you have a copy of the package, that it has the same contents as the package in the NPM registry. Thus, you can prove that a downloaded copy was not ...
user avatar
  • 1,058
0 votes

How to securely use `pass`, `sudo`, and `npm` on the same machine

That’s only a partial solution to your problem, but I do use a hardware token for my GPG key. Whenever the hardware token is unplugged, no malicious code can use my GPG key. Moreover, the hardware ...
user avatar
2 votes
Accepted

How to securely use `pass`, `sudo`, and `npm` on the same machine

running npm i ... not long after pass my-password allows a malicious package to steal my entire password store Yes, but not just that. Running npm i ... at any time before pass my-password allows a ...
user avatar

Top 50 recent answers are included