Npm Audit: broken by design?
overreacted.io
Npm Audit: broken by design?
1–10 of 268 posts
Re: Npm Audit: broken by design?
#2This is a general problem with many security scanning tools, and when a security team is empowered to give deadlines to fix any issue they report, leads to much frustration and poor relations in teams.
Imagine if you had 3 days to fix the regex DoS issue shown there, screw your release freeze and your current sprint plans, and you have the real working environment in some companies.
I've also heard reports of people trying to claim bug bounties for similar reports, or security vendors that run automated tools that detect for issues of similar (lack of) value.
Re: Npm Audit: broken by design?
#3We basically run it in CI... and then allow it to fail without failing the build. ¯\_(ツ)_/¯
It seems like a lot of this has been designed for Node (backend) development, whilst ignoring the fact that NPM is probably used more heavily for front-end development at this point.
Re: Npm Audit: broken by design?
#4Difficult problem to solve. It seems like the reasonable solution here is to have auditing integrated with the build system—but there are so many wacky build systems for JavaScript.
Re: Npm Audit: broken by design?
#5I've been saying this for years, especially to useless "prototype polution" notices being reported by npm audit. In a project where this "pollution" only happens on the nodejs side in our build tools, they are meaningless if our output is a browser JS bundle.
Re: Npm Audit: broken by design?
#6As someone who only had just gotten into front end programming after years of backend work, npm has been a nightmare. I haven't experienced the same level of frustration with other package managers (pip, cargo, go mod, etc) as I have with npm.
Is yarn the better option? What is our path forward?
Re: Npm Audit: broken by design?
#7I think they are just saying that context matters in security vulnerabilities, and npm audit doesn't have that context.
Well yes, correct, well done. By this metric, every security tool ever written is probably pointless.
Re: Npm Audit: broken by design?
#8As someone who only had just gotten into front end programming after years of backend work, npm has been a nightmare. I haven't experienced the same level of frustration with other package managers (pip, cargo, go mod, etc) as I have with npm. Is yarn the better option? What is our path forward?
I've been having a good experience with pnpm lately.
It's not a silver bullet but it addresses some pain points with npm/yarn.
Re: Npm Audit: broken by design?
#9As someone who only had just gotten into front end programming after years of backend work, npm has been a nightmare. I haven't experienced the same level of frustration with other package managers (pip, cargo, go mod, etc) as I have with npm. Is yarn the better option? What is our path forward?
same xd, npm even managed to make me appreciate maven and gradle
Re: Npm Audit: broken by design?
#10Excellent rundown of many problems I've encountered in recent versions of npm and node.
I've never ever got `audit fix` or `audit fix --force` to solve any of the mentioned vulnerabilities. Ever. I even relied on downloading every dependency one by one to find that there where other offending packages. I just gave up.
It's really useless and deceptive.