Post

Finn Bayer
@finnbayer.de

Did my first talk regarding npm supply chain attacks at an internal developer conference last week. 🎉 My main talking point: Pay attention. It is so easy to mindlessly run an npm install without thinking about possible consequences. 🧵

Finn Bayer
@finnbayer.de

Especially when you are a new developer you don’t even think about the possible pitfalls. This is why educating people is so important. I added @npmx.dev as an example because it does that in an unobtrusive way.

Finn Bayer
@finnbayer.de

When looking at a package I am informed about vulns and deprecated packages and can start my own journey of looking into the specifics and seeing if it affects me. It helps me to pay attention!

Finn Bayer
@finnbayer.de

There are things to improve (I for one would really like to see github.com/npmx-dev/npm... come to life) but even just right now in the canary state npmx.dev already helped me tremendously not only in regards to my presentation. I really appreciate the work of all the contributors ❤️

github.comflag `git:` and `https:` dependencies · Issue #1084 · npmx-dev/npmx.devThey can be manipulated, see https://bsky.app/profile/dsherret.bsky.social/post/3me2bmgc32k2k including in transitive dependencies, all the way to the top.
Finn Bayer
@finnbayer.de

Ok I tried to create a post because I am really happy that I gave the talk and wanted to mention and thank npmx but I was nervous about how it sounds so I reworded it again and again and after posting it I noticed it sounds like a LinkedIn post now… 🫣 well. You got to start somewhere.

0 reposts2 likes

No replies yet.