Staged publishing and new install-time controls for npm
1–10 of 17 posts
Re: Staged publishing and new install-time controls for npm
#2Nice…maybe will help some of the recent attacks
Re: Staged publishing and new install-time controls for npm
#3Nice…maybe will help some of the recent attacks
If maintainers actually use it
Re: Staged publishing and new install-time controls for npm
#4Re: Staged publishing and new install-time controls for npm
#5[dead]
Re: Staged publishing and new install-time controls for npm
#6Seen favorably, staged publishing is a band aid. Seen more realistically I believe that in the long run it will even hurt our efforts for more secure infra.
Re: Staged publishing and new install-time controls for npm
#7[dead]
Re: Staged publishing and new install-time controls for npm
#8Seen favorably, staged publishing is a band aid. Seen more realistically I believe that in the long run it will even hurt our efforts for more secure infra.
How could it possibly hurt?
For trusted publishing, it's not a band-aid, it's a significant improvement that kills an entire class of CI takeover publish attacks. I'm sure attackers will find another way but it's a big gap this is closing up.
Re: Staged publishing and new install-time controls for npm
#9Is any form of code analysis out of the question? Static and dynamic analysis of the code would seem like a promising idea rather than just trying to defer the update and hence the problem.
Re: Staged publishing and new install-time controls for npm
#10[dead]