Hacker News Reader

Why is a security tool used for checking package security shipped as a browser extension which have historically been pretty bad with security and permissions. Sorry but I don't want to install this when a website could do the exact same thing. Make a bookmarklet if you want it to be easy to use.

View on HN

There is a website here https://socket.dev where you can search for any OSS package and get the same information without the need for an extension.

The idea behind the extension is that it integrates directly into the developer workflow so you don’t have to remember to check a separate website.

What would really integrate with the developer workflow would be some kind of npm command that can check the package.json or the lock file and generate instant output on the console. You can then have whitelists, integration with CI/CD, and lots of other neat stuff.

We have that too :)

https://docs.socket.dev/docs/socket-cli

Reply on news.ycombinator.com