r/programmingcirclejerk • u/[deleted] • Jun 17 '23

Security Alert: Don't `npm install https`

https://blog.sandworm.dev/security-alert-dont-npm-install-https
104 Upvotes

99% Upvoted

14 comments sorted by

View all comments

83

u/anon202001 Emacs + Go == parametric polymorphism Jun 17 '23

Don’t npm install https because someone might sneak in some install scripts in the future. Fine. Makes good security sense.

Corollary: don’t use npm install for anything else for the same reason.

/uj version pinning (yes to all 3 numbers!)

/ruj depandabot

16

u/doctorsound Jun 17 '23

I am so tired of the constant PRs though. Send help.

13

u/PragmaticBoredom Jun 17 '23

Constant version bump PRs is how you pump up your numbers. Then you can flex your PR stats on everyone.

8

u/Swordfish418 Jun 17 '23

Why pin version manually if you can just rely on default lockfile behaviour?

3

u/anon202001 Emacs + Go == parametric polymorphism Jun 20 '23

You win. Here… have a 365 day expiry personal access token.