undefined | Better HN

vitaliyf8y ago· 7 in thread

You run a private NPM mirror where you copy dependencies that you rely on, after auditing them (for code quality and licensing).

fareesh8y ago

Realistically if someone were to sneak something in, what kind of audit would you need to be able to catch it?

StavrosKOP8y ago

Wouldn't just pinning the hash of a package be a better solution?

tomjakubowski8y ago

That’s probably fine from the security perspective, but the hash won’t make the package re-appear if it disappears out of nowhere. That’s the other benefit of a private/on-premesis mirror.

2 more replies

the_duke8y ago

Easiest solution without infrastructure imo is to vendor node_modules as a git submodule.

(Of course it's even easier to just add node_modules to the repo but that is messy).

aabbcc12418y ago

and you better fork the git repo, otherwise the incident happening to npm can happen on github / whatever remote repo.

chris_78y ago

I don't know JS, but this sounds like a lot more work than just checking everything into your repo?

weinzierl8y ago

This, or if you have the money there are companies that do that for you.

perlgeek8y ago

Have a local mirror with the relevant packages, or a caching proxy.

MarkyC48y ago

create a mirror registry containing the packages you depend on

astrobe_8y ago

Git or similar?

0 comments

0 comments