Post

David Sherret
@dsherret.dev

How to bypass minimum dependency/release age: 1. Publish an npm package with an unpinned git dependency. 2. Get usage and wait many months. 3. Push a malicious commit to the git dependency's repo.

David Sherret
@dsherret.dev

How to recreate leftpad: 1. Publish an npm package with a git dependency. 2. Get usage and wait many months. 3. Delete the repo.

David Sherret
@dsherret.dev

Both of these are also possible using https dependencies in an npm package. Worst part is in some cases the package wouldn't easily be able to be taken down. npm, pnpm, and bun all happily install this kind of stuff—`deno install` errors.

0 reposts4 likes

David Sherret
@dsherret.dev

Several popular npm packages transitively have this problem, including a recent popular one. It's only a matter of time before someone takes advantage of this.

David Sherret
@dsherret.dev

It's good there's the option, but most people won't and don't do this. In my opinion, it's something that should be opt-in instead of opt-out in all the tools. For example, you can be hit by this while working on a project that doesn't have linting and you update a dependency.