はてなブックマーク - Why npm lockfiles can be a security blindspot for injecting malicious modules | Snyk
https://b.hatena.ne.jp/entry/s/snyk.io/blog/why-npm-lockfiles-can-be-a-security-blindspot-for-injecting-malicious-modules/
I recently started playing around with the idea of threat modeling packages on the npm ecosystem. Can an event-stream incident happen again? How about other supply chain attacks? What will be the n...tjmtmmnk
https://b.hatena.ne.jp/tjmtmmnk/20220405#bookmark-4675309341552385794
2022-04-04T23:36:51Znpmmkusaka
https://b.hatena.ne.jp/mkusaka/20191231#bookmark-4675309341552385794
2019-12-31T11:36:46Zasayamakk
https://b.hatena.ne.jp/asayamakk/20191224#bookmark-4675309341552385794
2019-12-24T02:26:04Zyosuke_furukawa
https://b.hatena.ne.jp/yosuke_furukawa/20191223#bookmark-4675309341552385794
2019-12-23T12:52:53Ztuki0918
https://b.hatena.ne.jp/tuki0918/20191004#bookmark-4675309341552385794
2019-10-04T00:19:23ZShisama
https://b.hatena.ne.jp/Shisama/20191004#bookmark-4675309341552385794
package-lock.jsonやyarn.lockを使った悪意あるモジュールのインジェクションについて。lockfileはレビューされないことにより起こりうるのでlockfile-lintを活用したりlockfileの修正はコアメンテナのみに制限などで対策2019-10-03T15:28:36Znpmsecurityteppeis
https://b.hatena.ne.jp/teppeis/20191003#bookmark-4675309341552385794
2019-10-03T14:47:56Znpm