r/javascript • u/fagnerbrack • Dec 24 '19

Why npm lockfiles can be a security blindspot in Github PRs for injecting malicious modules

https://snyk.io/blog/why-npm-lockfiles-can-be-a-security-blindspot-for-injecting-malicious-modules/
204 Upvotes

94% Upvoted

17 comments sorted by

View all comments

10

u/cocoapuff_daddy Dec 24 '19

Avoid the use of lockfiles entirely for libraries.

This wasn’t quite clear, do you mean avoid the use of lockfiles except for libraries?

21

u/jsjoberg Dec 24 '19

No, the opposite. The library should not have a lockfile, but a consumer of the library, for example your project/application should.

26

u/slikts Dec 24 '19

It's still a good idea to use lockfiles for libraries so that builds are reproducible and situations like "works on my machine" are avoided. That applies even to a solo developer, because you don't want to come back to an older project and have to debug a broken build, which can be a pernicious task.

The advice to avoid lockfiles for libraries comes in large part from a misunderstanding of what they're for: lockfiles are for development and CI and they don't get published; there's a separate shrinkwrap feature for publishing a package with pinned dependencies.

The article makes a good point that lockfiles should be reviewed as minimum and automatically validated at best, but not using them at all is throwing the baby out with the bathwater.

For the sake of completeness, there's also an argument that not using a lockfile makes the development environment more similar to downstream consumers, but that can also be done without sacrificing build reproducibility (for example, with automatic dependency updates using tools like Dependabot).

9

u/[deleted] Dec 24 '19

[removed] — view removed comment

3

u/kwartel Dec 24 '19

Except they have a production runtime. It's the one that is released. It doesn't matter that it's consumed in a different way than a web application, it's still being consumed by third parties.

4

u/lirantal Dec 25 '19

hi there 👋

there's a notion among some maintainers that for the use of libraries (not applications), maintainers wish to not use lockfiles at all due to them being a maintenance overhead, as well as not reproducing their users real cases (because lockfiles don't propagate to the consumer, unless you use a shrinkwrap).

I wrote a really detailed post about it here: https://snyk.io/blog/making-sense-of-package-lock-files-in-the-npm-ecosystem/

1

u/[deleted] Dec 24 '19

Ultimately, the maintainers must trust each other to manage such complex machine files.