Post

Finn Bayer
@finnbayer.de

Did my first talk regarding npm supply chain attacks at an internal developer conference last week. 🎉 My main talking point: Pay attention. It is so easy to mindlessly run an npm install without thinking about possible consequences. 🧵

Finn Bayer
@finnbayer.de

Especially when you are a new developer you don’t even think about the possible pitfalls. This is why educating people is so important. I added @npmx.dev as an example because it does that in an unobtrusive way.

0 reposts2 likes

Finn Bayer
@finnbayer.de

When looking at a package I am informed about vulns and deprecated packages and can start my own journey of looking into the specifics and seeing if it affects me. It helps me to pay attention!

Finn Bayer
@finnbayer.de

There are things to improve (I for one would really like to see github.com/npmx-dev/npm... come to life) but even just right now in the canary state npmx.dev already helped me tremendously not only in regards to my presentation. I really appreciate the work of all the contributors ❤️

github.comflag `git:` and `https:` dependencies · Issue #1084 · npmx-dev/npmx.devThey can be manipulated, see https://bsky.app/profile/dsherret.bsky.social/post/3me2bmgc32k2k including in transitive dependencies, all the way to the top.
Finn Bayer
@finnbayer.de

Ok I tried to create a post because I am really happy that I gave the talk and wanted to mention and thank npmx but I was nervous about how it sounds so I reworded it again and again and after posting it I noticed it sounds like a LinkedIn post now… 🫣 well. You got to start somewhere.

Pelle Wessman
@voxpelli.com

Sadly it also goes beyond mere facts like these to flag opinionated stuff which hurts the creation of a sustainable and friendly atmosphere within OSS.

Pelle Wessman@voxpelli.com

How can using one’s platform to lobby against another maintainers actively maintained module – and seeking to steer people away from it – in any way be considered “welcoming”, “safe”, “equitable” or respecting and promoting of the “dignity”, “rights” and “contributions” of those individuals?

Finn Bayer
@finnbayer.de

I know this feature and I really like it. Especially the case you presented. dotenv is an amazing project and it is still actively maintained. It still serves a purpose. But since node 20.6 it may not be necessary to depend on it anymore because there is a similar functionality built-in now.

Finn Bayer
@finnbayer.de

The banner shows exactly that. It tells me that I MIGHT not need it. And with that it educates me. It shows me sth I might have missed. And it could help reduce my attack surface by relying on less third party dependencies.