Hacker News Reader

So the audit was mostly about nom the website and the service for maintaining npm packages? That's a good first step.

Has there been any talk within the node community about auditing node modules themselves? Maybe start with the most popular? I could see this being popular with enterprise development, etc.

I want to say that Strong Loop made noise about doing something like this, but I haven't seen much on it of late.

View on HN

One of the Node Security Project (https://nodesecurity.io/) main efforts is to audit all the npm modules in a community driven way.

We are accepting contributions from the community to build the tools that get the job done efficiently and to audit modules, disclosing vulnerabilities in a responsible manner.

I'll take a look, thanks. Some reviews will, of course, be manual in nature -- implementation correctness of digest auth, for instance, is one that comes to mind (I need to contribute that back to a particular module).

Reply on news.ycombinator.com