hansott

> How do you prevent supply chain compromises like this? Take a look at https://github.com/AikidoSec/safe-chain and https://intel.aikido.dev/?tab=malware! Disclaimer: I work at Aikido Security :)

Only install npm dependencies in a Docker container, e.g. dev containers offers an easy way to do that (the speed on macOS isn't great but hey)

Aikido scans all published npm packages in realtime: https://intel.aikido.dev/?tab=malware

Couple of thoughts:

Make it available through a web page instead of a raw search dump?

Hide the internals of your search engine? In case you want to switch to meilisearch, algolia, ... (for cost reasons)

Preferably use your own search DSL to avoid users to learn about Elasticsearch queries (goes hand in hand with hiding internals of search engine)

Good luck! :)

Reminds me of https://twitter.com/ircmaxell/status/984785734811963392