Finn Bayer

nesbitt.ionpm's Defaults Are BadThe npm client's default settings are a root cause of JavaScript's recurring supply chain security problems.

23 May

While I agree with this take it should still be a set value in every current config just to make sure that every person gets the benefit. Even if persons use a version of a package manager that does not set a default (pnpm before v11, current Npm versions etc). Goal: default in pm + set config value

Wes@notwes.bsky.social

I will add a personal opinion: putting this config in every user repo is an asinine decision from a maintainability perspective. Secure defaults (which could include a delay until a package can be scanned before being available from the registry) is a much more scalable solution.

Finn Bayer reposted

Yarn

@yarnpkg.dev

17 Apr

We just released the 4.14 branch! 🎊 Two important security changes: - `enableScripts` now defaults to `false` (can be overridden on a per-package basis) - A new `approvedGitRepositories` setting should be used to tell Yarn which git repos are safe to pack.

Finn Bayer reposted

Mike McQuaid

@mikemcquaid.com

31 Mar

One of the strengths of Homebrew, despite it being unpopular, is being willing to break backwards compatibility when necessary. NPM’s unwillingness to do so reflects GitHub’s: both show excessive caution that harm both security and usability.

github.comfeat: add min-release-age by wraithgar · Pull Request #8965 · npm/cliThis is a new config that is a way to populate the "before" config using a relative date integer. This deceptively small change was the result of a LOT of work to get to this point, prima...

A lot has happened in the last two minor releases of the npm cli that is important to know for people using it: v11.9 : allow-git flag v11.10: min-release-age 🧵

npm v11.10 added the min-release-age config that allows you to delay the installation of newly released package versions. That was possibly with the —before flag but min-release-age lets you specify a relative number of days directly from your .npmrc (github.com/npm/cli/pull...)

docs.npmjs.comnpm-install | npm DocsInstall a package

You can use them by adding allow-git=none min-release-age=7 to your .npmrc. Look at the specifics of the configs in the docs: docs.npmjs.com/cli/v11/comm...

A lot has happened in the last two minor releases of the npm cli that is important to know for people using it: v11.9 : allow-git flag v11.10: min-release-age 🧵

koi.aiPackageGate: 6 Zero-Days in JS Package Managers But NPM Won't ActWe found 6 zero-day vulnerabilities in npm, pnpm, vlt, and Bun that bypass --ignore-scripts and lockfile protections. Five patched. npm closed the report.

npm v11.9 (shipped with the current lts version of node) introduced the allow-git flag that lets you block the installation of dependencies from git. This prevents an attack vector that allowed rce even with ignore-scripts present. Thanks to #koi.ai for there work www.koi.ai/blog/package...

github.comflag `git:` and `https:` dependencies · Issue #1084 · npmx-dev/npmx.devThey can be manipulated, see https://bsky.app/profile/dsherret.bsky.social/post/3me2bmgc32k2k including in transitive dependencies, all the way to the top.

28 Feb

Did my first talk regarding npm supply chain attacks at an internal developer conference last week. 🎉 My main talking point: Pay attention. It is so easy to mindlessly run an npm install without thinking about possible consequences. 🧵

There are things to improve (I for one would really like to see github.com/npmx-dev/npm... come to life) but even just right now in the canary state npmx.dev already helped me tremendously not only in regards to my presentation. I really appreciate the work of all the contributors ❤️

28 Feb

Ok I tried to create a post because I am really happy that I gave the talk and wanted to mention and thank npmx but I was nervous about how it sounds so I reworded it again and again and after posting it I noticed it sounds like a LinkedIn post now… 🫣 well. You got to start somewhere.

Especially when you are a new developer you don’t even think about the possible pitfalls. This is why educating people is so important. I added @npmx.dev as an example because it does that in an unobtrusive way.