This should be related, but I haven't tried it (my brother builds it, so I am not affiliated) https://requiresecurity.com/
Ask HN: How do you security-audit external software using NPM packages?
41–50 of 85 posts
Re: Ask HN: How do you security-audit external software using NPM packages?
#42I would love to know what you specifically look for in Wordpress plugins, especially on the PHP side. I've written quite a few but would appreciate some tips on security.
If you prefer a private discussion, my gmail username is the same as my HN username. Thank you!
Re: Ask HN: How do you security-audit external software using NPM packages?
#43Snyk and Dependency Check are two tools I've used when performing security checks.
Re: Ask HN: How do you security-audit external software using NPM packages?
#44Nexus Lifecycle / Nexus Auditor tends to be useful for this - in absence of a package.json it crawls the raw js files and finds their source. It can help figure out things like embedded jqueries etc. That being said, it has the same limitation as other tools - minification and bundling obfuscates origins and makes it harder to assign identity to the source package.
The only way that I can think of getting around this is to have a hard requirement for a source registry - or asking the premium plugin producers to produce a SBOM like cyclonedx or spdx and evaluate that in lieu.
Re: Ask HN: How do you security-audit external software using NPM packages?
#45If any software pulls in more than a few independent npm packages, I call it a huge risk and sandbox it as if it's a ticking time bomb. After some deliberation I've come to the conclusion this is a reasonable approach with all software. It's for me a nice approach to deny every capability unless it is critical for the functioning (that you want) of the software. If that's "full network access and subprocess spawn capability", then you should probably not be using it anyway.
Re: Ask HN: How do you security-audit external software using NPM packages?
#46I believe one thing that can help security a little is to use full version numbers in your dependency list. This applies to all package managers.
Because the moment someone hits update on the package manager nothing will get updated and you won't receive potential dangerous updates you did not review first.
Edit: sorry this is not relevant to the question...
Re: Ask HN: How do you security-audit external software using NPM packages?
#47If any software pulls in more than a few independent npm packages, I call it a huge risk and sandbox it as if it's a ticking time bomb. After some deliberation I've come to the conclusion this is a reasonable approach with all software. It's for me a nice approach to deny every capability unless it is critical for the functioning (that you want) of the software. If that's "full network access and subprocess spawn cap…
What's your strategy/stack of sandboxing, and on what os?
Re: Ask HN: How do you security-audit external software using NPM packages?
#48Independent of the language, I only use external code if it is small enough that I can manually review it. Often I refactor it into a single file during this process. This of course excludes the majority of packages out there. But apart from security, it has another benefit: These dependency very rarely break and need updates. So compared to projects with a more complex stack, projects with a lean stack are easier to…
Refactoring into a single file sounds like a bit of a pain, since you have to do it every time the external code gets updated. Also how do you deal with dependencies that come with their own dependencies? Do you avoid them?
This may be slightly tangential but I recently discovered ncc[1] from vercel which can take a single node project and compile it and all dependencies to a single file.
As an added benefit it also collapses all contained dependencies license files into a single licenses.txt file too!
Re: Ask HN: How do you security-audit external software using NPM packages?
#49I am maintainer of couple of OSS projects https://github.com/ossf/scorecard https://github.com/ossf/package-analysis
These projects help with repository best practices and does some level of npm package analysis based on rules.
Re: Ask HN: How do you security-audit external software using NPM packages?
#50I am maintainer of couple of OSS projects https://github.com/ossf/scorecard https://github.com/ossf/package-analysis These projects help with repository best practices and does some level of npm package analysis based on rules.
These projects are under https://github.com/ossf which is part of Linux foundation.