←back to thread

NPM debug and chalk packages compromised

(www.aikido.dev)
1369 points universesquid | 1 comments | 08 Sep 25 15:37 UTC | HN request time: 0.212s | source
Show context
simpaticoder ◴[08 Sep 25 16:41 UTC] No.45170488[source]▶
I've come to the conclusion that avoiding the npm registry is a great benefit. The alternative is to import packages directly from the (git) repository. Apart from being a major vector for supply-chain attacks like this one, it is also true that there is little or no coupling between the source of a project and its published code. The 'npm publish' step takes pushes local contents into the registry, meaning that a malefactor can easily make changes to code before publishing.
replies(5): >>45170843 #>>45171235 #>>45171399 #>>45172081 #>>45175895 #
1. komali2 ◴[08 Sep 25 17:08 UTC] No.45170843[source]▶
Do you do this in your CI as well? E.g. if you have a server somewhere that most would run `npm install` on builds, you just `git clone` into your node_modules or what?