411–420 of 458 posts
Earlier quoted context omitted.
What exactly would you have done differently? Cargo made its debut in 2014, a year before the infamous left-pad incident, and three years before the first large-scale malicious typosquatting attacks hit PyPI and NPM. The risks were not as well-understood then as they are today. And even today it is very far from being a solved problem.
Yet Go is half a decade older and seems to have handled the situation much better.
https://github.com/doy/rbw is a Rust alternative to the Bitwarden CLI. Although the Rust ecosystem is moving in NPM's direction (very large and very deep dependency trees), you still need to trust far fewer authors in your dependency tree than what is common for Javascript.
It's a bit ironic that everyone considers Rust as safer while completely ignoring the heavily increased risk of pulling in malware in dependencies.
Earlier quoted context omitted.
The lack of a comprehensive standard library for JavaScript also results in projects pulling many more third party dependencies than you would with most other modern environments. It’s just a bigger attack surface. And if you can compromise a module used for basic functionality that you’d get out of the box elsewhere, the blast radius will be enormous.
So why hasn’t someone created a batteries include JS library? I don’t program in JS on the backend so I don’t know how feasible something like that is.
Earlier quoted context omitted.
Update dependencies when you need something in them, not just because there's a new version available.
But then at the same time you should always update because it might fix a security vulnerability. Otherwise you end up running nodejs 10 because you don't need the new stuff.
Earlier quoted context omitted.
I don't understand how this solves the issue in this case. Bitwarden vaults were not compromised, there was a problem in a tool you used to access the secrets. What makes it impossible for KeePass access tools to have these issues?
> I don't understand how this solves the issue in this case. I'd say since it is a local only tool, you don't really need to update it constantly provided you are a sane person that don't use a browser extension. It makes it easier to audit and yourself less at risk of having your tool compromised. It doesn't have to be keypass though, it can be any local password management tool like pass[1] or its guis or simply a…
Earlier quoted context omitted.
Why?
Because they could have a security flaw that might compromise your project or any users of it.
Earlier quoted context omitted.
How to prevent it? tl;dr - https://cooldowns.dev - https://depsguard.com (disclaimer: I maintain the 2nd one, if I knew of the first, I wouldn't have released it, just didn't find something at that time, they do pretty much the same thing, mine in a bit of an overkill by using rust...)
Do either of those work on browser extensions that I install as a user? I don't see anything relating to extensions in there.
Earlier quoted context omitted.
It seems less likely that they'll find it before you're bitten by it if you intentionally race against them by choosing newest all the time, yea?
Maybe we can let people that don't care about privacy try them first
It's not a lack of care about privacy, the 7 days delay is like a new stage between RC and final release, where you pull for testing but not for production.
Anyone know of a better way to protect yourself than setting a min release age on npm/pnpm/yarn/bun/uv (and anything else that supports it)? Setting min-release-age=7 in .npmrc (needs npm 11.10+) would have protected the 334 unlucky people who downloaded the malicious @bitwarden/cli 2026.4.0, published ~19+ hours ago (see https://www.npmjs.com/package/@bitwarden/cli?activeTab=versi... and select "show deprecated vers…