back

by stagas·4y ago·view on hn ↗
You can mitigate against those kinds of attacks using npm's `--before` option:

     npm i --before=`date -I -d '-5 days'`
It will only install packages released before the specified date.
1 comments
I think this is engendering a false sense of security. NPM's awful documentation doesn't specify whether it's possible for a dependency published 1 year ago to install, via a wildcard [transitive] dependency, a dependency updated today[0]. I have absolutely zero faith in the NPM devs' having considered this.

[0] In fact, it doesn't specify this flag at all. Nor does the command line help, or man page. It doesn't say a word about this, and it appears the only way to determine the semantics of this flag is to run it.