Post

Finn Bayer
@finnbayer.de

A lot has happened in the last two minor releases of the npm cli that is important to know for people using it: v11.9 : allow-git flag v11.10: min-release-age 🧵

0 reposts1 like

Finn Bayer
@finnbayer.de

npm v11.9 (shipped with the current lts version of node) introduced the allow-git flag that lets you block the installation of dependencies from git. This prevents an attack vector that allowed rce even with ignore-scripts present. Thanks to #koi.ai for there work www.koi.ai/blog/package...

koi.aiPackageGate: 6 Zero-Days in JS Package Managers But NPM Won't ActWe found 6 zero-day vulnerabilities in npm, pnpm, vlt, and Bun that bypass --ignore-scripts and lockfile protections. Five patched. npm closed the report.
Finn Bayer
@finnbayer.de

npm v11.10 added the min-release-age config that allows you to delay the installation of newly released package versions. That was possibly with the —before flag but min-release-age lets you specify a relative number of days directly from your .npmrc (github.com/npm/cli/pull...)

github.comfeat: add min-release-age by wraithgar · Pull Request #8965 · npm/cliThis is a new config that is a way to populate the "before" config using a relative date integer. This deceptively small change was the result of a LOT of work to get to this point, prima...