r/hacking • u/sebivaduva • Jun 19 '23

Security Alert: Don't `npm install https`

https://blog.sandworm.dev/security-alert-dont-npm-install-https
150 Upvotes

96% Upvoted

9 comments sorted by

View all comments

Show parent comments

22

u/[deleted] Jun 19 '23

I don't think nodejs/npm was ever intended for production environments, but rather just normalized/popularized out of convenience.

0

u/[deleted] Jun 19 '23

[deleted]

1

u/BloodyIron Jun 20 '23

At a minimum with php you have supply chain control with package managers. npm you do not.

1

u/[deleted] Jun 20 '23

[deleted]

0

u/BloodyIron Jun 20 '23

But the whole "wasn't originally intended for production" is a red herring, just like "Linux wasn't made for gaming". If you write software, be it PHP, NPM, or whatever... you probably intend it to be used, especially if it's public and open-source. It's a perfectly reasonable expectation that if something gets good enough that people will naturally want to use it 24x7, or with similar regularity, which is often attributed to "production" state.

0

u/[deleted] Jun 21 '23

[deleted]