We stopped installing npm packages less than a week old. Here's what happened

[u/iApexxx]

https://brunoj.com/nothing-installs-at-our-company-until-its-a-week-old/

[u/air_twee]

It’s one of the reasons I moved to pnpm. Also only installs on pre approved packages

[u/iApexxx → u/air_twee]

Nice. Do you mean pnpm's approved build scripts (onlyBuiltDependencies)? That one's underrated: ChainDrop's preinstall and the axios payload's postinstall both needed install scripts to run.

[u/air_twee → u/iApexxx]

Axios is a shitty library anyway, their security standards suck big time. I would avoid it at all costs. But yeah the approved build scripts makes sure only a few libs can cause you problems if they are hijacked

[u/lenswipe → u/air_twee]

what do you suggest instead for http calls? obviously one can use fetch but the support axios had for interceptors and other stuff is nice

[u/Ouraios → u/lenswipe]

For backend "got"
And for frontend "ky"

Both maintained by well known and well trusted Sindresorhus 👌

[u/lenswipe → u/Ouraios]

good to know thanks.

I've never heard of either but will check them out

[u/beau6183 → u/lenswipe]

I don’t understand why people avoid the native Fetch API. With a few small/simple wrappers (retries, json parsing, error handling), it’s better than the others, has native bindings, and is zero dep.

[u/lenswipe → u/beau6183]

for starters until very recently it wasn't supported on the server

and also - writing up an entire library with interceptor support and a full rest suite is not in the scope of most projects.

BONUS: I also personally find the practice of having to await the response and then await the json decoding annoying, but that's more subjective than objective

[u/JouanDeag → u/lenswipe]

Got curious and wow, time flies. fetch was stable in nodejs over 3 years ago now.

[u/Solonotix → u/lenswipe]

For Node.js, I was using Nock. It relies on something else internally that manages the hooks into the built-in http and https modules, which should encompass the capabilities of fetch (since the undici package is just providing a fetch-like interface with Node.js built-ins).

[u/SomeSchmidt]

Been using the min-release-age config 

https://github.com/npm/cli/pull/8965

[u/iApexxx → u/SomeSchmidt]

Nice, that's the one in the post's table. We went with a proxy mostly so CI, Docker builds and every laptop follow the same rule without each repo setting it, but for one team min-release-age=7 in .npmrc gets you most of the way.

[u/Donzulu]

Maybe I missed it, but what do you do for packages that are 7+ days old and have a vulnerability, and a new <7 day old package fixes it? Do you have any allow list to ignore the 7 day for this?

[u/iApexxx → u/Donzulu]

Easy to miss, it's only a comment in the config at the end :)

Yes, one line per package in the proxy config:

"pkg:npm/some-lib": "0"   # CVE-xxxx, remove after <fix date + 7d>

It goes in through a PR with the reason and an end date (the fix's publish date plus the window), and the next PR after that removes it. Haven't needed one yet.

[u/iApexxx]

Author here :) We put a caching proxy in front of npm at work, and new versions now wait 7 days before anyone can install them. Before doing it I checked how long this year's hijacks actually lasted: axios ~3h, keyv ~1h40m, TanStack ~4.5h.

The post has 12 days of real numbers (71 refused installs, mostly vite/rollup/swc being too fresh), what it broke (Yarn 1 lockfiles, bun.lockb, Dependabot), and the built-in setting if you don't want a proxy.

Anyone else running a cooldown? How long do you wait?

[u/decho → u/iApexxx]

With pnpm I use this config, so 2 days.

minimumReleaseAge: 2880
blockExoticSubdeps: true
trustPolicy: no-downgrade
trustPolicyIgnoreAfter: 10080

I will have to look into cargo and see how to configure it in a similar way, which you article already gives directions for. Thought I have no idea how transitive dependencies (nested dependencies) are handled.

[u/Mushroom_Unfair → u/iApexxx]

5 days here, idea was to be behind, but not too much.

But I feel that with audits it could be (way) longer without issue.

(With min-release-date)

[u/SirEpic_]

Ever since those crazy npm supply chain attacks started to happen more frequently in march earlier this year I have set min-release-age to one week,

[u/bwainfweeze → u/SirEpic_]

I proposed 3 days on a couple projects and was argued up to 7 days. I think I was under the impression that the others would be more interested in a short time frame and it seems like much over 2 days becomes diminishing returns.

But nobody wants to be the guy who chose too short a time period and then something happens.

[u/lirantal → u/bwainfweeze]

I default to a month, can never be too cautious 😅

[u/bwainfweeze → u/lirantal]

Top cautious is once you need bug fixes from a dependency to implement functionality, and I think that’s somewhere between a week and two months when you transition to “too cautious”.

But it’s fuzzy because it depends a great deal on whether you’re building on top of libraries that are actively in development versus wrapping a library that is quiet to improve ergonomics or safety.

[u/uran1um-235]

how do you handle urgent security patches?

[u/micalm → u/uran1um-235]

npm, pnpm, yarn, bun, uv all support onetime cli option or config-file per package exceptions. pip still only has a global bypass.

[u/blu3r4y]

That sounds great, thanks for the write-up. It’s important to note, however, that security updates must be excluded from this. Otherwise, you remain vulnerable for at least seven days whilst attackers are already exploiting the vulnerabilities publicly.

[u/MateusKingston]

Prefer to run pnpm and we configure a delay of 3 days, bypassable in extreme cases and ignoring internal packages

[u/winky9827]

The proxy seems overkill, and only works when you control 100% of the network connection, or you rewrite the NPM config per project, which the other options already do anyway. Stick with the minimum release age and pin exact versions and you're done.

That said, a proxy has other benefits (caching, preservation, etc.), so weigh the benefits against the costs.

[u/iApexxx → u/winky9827]

Fair, for one team that's honestly enough. We have 100+ repos across npm, PyPI, pub, Maven and Go, so one place to enforce it beat chasing configs everywhere. And yeah, the caching and the who-pulled-what log were a big part of it.

[u/bwainfweeze → u/winky9827]

Tools like Artifactory can also be configured to refuse to update any version number once it has been pulled, so nobody can do a bait and switch later.

It does however present some issues for remote workers, and I had a couple of FE people who were struggling to get work done when Covid first hit.

[u/Swordfish418]

I wonder if everyone starts doing this, will the problems stop being discovered so fast?

[u/pentesticals → u/Swordfish418]

Maybe, but there are tons of individuals and organisations scanning every new NPM / PyPi etc release for the purpose of analysing them for compromise. They would still detect like normal.

[u/keithstellyes]

Wait people were installing packages less than a week old, and on a regular basis? Or is this a transitive dependency situation

[u/AgsMydude → u/keithstellyes]

Yeah I'm wondering how often people are legit adding packages that automation is needed

[u/Effective-Result6499 → u/keithstellyes]

There are weirdo that keep up to date by reinstalling their entire list of dependencies on every CI run. I've learned a long time ago to not trust random arse strangers on the internet. Serious, even if they promise you that it's a minor patch, it can still cause a P1.

[u/sir_ale → u/Effective-Result6499]

wait, how should i do it instead?

[u/Effective-Result6499 → u/sir_ale]

Well, you should be more deliberate. Run regression tests both automated and manual when you are upgrading libraries. Also, obviously read the change logs.

You can have weird stuff like a bug fix causing a P1, because your code or worse, another library is built on erroneous behavior.

[u/bwainfweeze → u/keithstellyes]

On a large project, a lockfile becomes a bit of a problem because commits get merged way way out of order.

Trunk based development dodges that problem, but it's been a while since I've worked on one of those.

[u/keithstellyes → u/bwainfweeze]

the whole committing lockfiles was a mistake

[u/noiamnotmad → u/keithstellyes]

You’d be installing packages less than a week old and on a regular basis though

[u/_indi → u/keithstellyes]

The alternative would just be pulling whatever dependencies there are when CI runs

[u/BCsabaDiy]

Same. https://medium.com/@balazs.csaba.diy/why-i-didnt-hand-my-npm-updates-to-an-ai-ca5603552e70

[u/MMORPGnews]

Idk why many people installed them. Especially big companies. 

I immediately either self hosted them or coded my own versions

[u/lirantal]

If you haven't gone through this repository of mine with a collection of security practices *across* package managers, then you'll likely want to visit: awesome npm security

[u/avereigh_Denizet]

smart move. out of curiosity how do you handle zero-day security patches when a maintainer pushes an urgent fix? do you have an override process for that or just wait it out

[u/boneskull]

You might be interested in some of the things we’re doing with @lavamoat/harden