safe-install: npm installs with trusted build dependencies…
0 reactions
safe-install: npm installs with trusted build dependencies
In light of the ongoing npm supply chain compromises, I built safe-install:
https://www.npmjs.com/package/@gkiely/safe-install
It brings a couple of protections I wanted from npm but are not built in.
Similar to Bun’s trusted dependencies, it lets you disable install scripts and define a list of dependencies that are allowed to run build/install scripts:
https://bun.com/docs/guides/install/trusted
It also supports blocking exotic sub-dependencies, similar to pnpm’s \`blockExoticSubdeps\` setting:
https://gajus.com/blog/3-pnpm-settings-to-protect-yourself-f ... https://gajus.com/blog/3-pnpm-settings-to-protect-yourself-from-supply-chain-attacks#2-set-blockexoticsubdeps
#programming #js #technology #dev
In light of the ongoing npm supply chain compromises, I built safe-install:
https://www.npmjs.com/package/@gkiely/safe-install
It brings a couple of protections I wanted from npm but are not built in.
Similar to Bun’s trusted dependencies, it lets you disable install scripts and define a list of dependencies that are allowed to run build/install scripts:
https://bun.com/docs/guides/install/trusted
It also supports blocking exotic sub-dependencies, similar to pnpm’s \`blockExoticSubdeps\` setting:
https://gajus.com/blog/3-pnpm-settings-to-protect-yourself-f ... https://gajus.com/blog/3-pnpm-settings-to-protect-yourself-from-supply-chain-attacks#2-set-blockexoticsubdeps
#programming #js #technology #dev
| 3,000 mlx | |
| 6 | |
| 0 |