Hacker News Reader

Comment by general_reveal | Hacker News Reader

That’s why I switched to Java.

You are absolutely right. The dangerous part of NPM packages is the post-install script. Therefore moving from JavaScript to Java removes the threat.

You joke but, yeah, when you think about it, the problem with Javascript is the 'script' part. That's actually correct.

    AbstractFinalFactoryShaiHuludSerialisedFactory

Yeah but you don’t have to use that I think. I think us Node people can just pretend to write Ecmascript 2 in Java and be fine.

https://dayssincelastjavascriptframework.com

…. lol

Meh maven plugins are just as juicy a target as npm is

What do u recommend?

https://github.com/s4u/pgpverify-maven-plugin

If you want paranoid mode, you can verify literally every part of the maven build process.

Reply on news.ycombinator.com