Hacker News Reader

Comment by crispyporkbites | Hacker News Reader

I have a package on NPM which is only partially implemented, using it in a production app is a bad idea, a quick glance at the source code or the todo section of the readme makes it pretty obvious. I still gets bug reports and npm says it has hundreds of download every month.

For anything serious, read the source code, at the very least check your dependencies.

View on HN

fwiw as a former npm registry engineer i can tell u that "hundreds of download every month" likely is a result of the background bot activity npm gets. but your advice is sound! definitely vet your deps before you use them! and YES! read the source.

Is this realistic though? Every time you update a dependency you would have to read its source (and its source dependencies, and their source dependencies...)

To do that well, it would be someone's fulltime job to read and do security audits on all those dependencies.

Theoretically, once something is updated all you would have to do is check the diff. Still tedious though.

I look forward to all the clever exploits that result from benign-looking code being added to benign-looking code.

Last time I went to one of the Bay Area node meetups, that given meetup was being sponsored by just such a company. Can't remember the name, unfortunately.

The idea was though that you'd feed them your package.json and they'd let you know of any vulnerabilities, iirc. Or maybe they had a private repo of packages they'd checked? Can't remember.

Possibly https://snyk.io/ ?

The argument in that article is that it doesn't matter what is in the source. The published package has no guarantees to be from the source.

Reply on news.ycombinator.com