Ask HN: How secure is the JavaScript NPM eco-system?

#1

Post by Blackstone4 » Wed, May 23, 2018, 10:53 AM UTC

I feel like security is a big issue for the JS eco-system. Every app replies on at 10 if not more modules. Each of those modules then imports a bunch of other modules. You often end up with 100+ modules in node_modules/

Is this as big an issue as I think it is? Who checks the code? I would love to get HNers view on this.

Re: Ask HN: How secure is the JavaScript NPM eco-system?

#2

Post by wolololo33 » Wed, May 23, 2018, 11:07 AM UTC

Probably no one. It only takes one deranged mind to leave something innocent in a tiny module.

Re: Ask HN: How secure is the JavaScript NPM eco-system?

#3

Post by finchisko » Wed, May 23, 2018, 11:14 AM UTC

>Who checks the code?

This is not specific to NPM. You can ask the same question for any language repository. And the answer will be in the most cases same.

Re: Ask HN: How secure is the JavaScript NPM eco-system?

#4

Post by Blackstone4 » Wed, May 23, 2018, 11:18 AM UTC

finchisko wrote: post #3

>Who checks the code? This is not specific to NPM. You can ask the same question for any language repository. And the answer will be in the most cases same.

True but with NPM, I feel like the surface area is much larger because of the number of modules.

If you use Golang, then you'll mostly be using the stdlib plus some libraries. A much smaller surface area and checking that code becomes more feasible.