Improve Security of node_modules and package.json Resolution · Issue #43192 · nodejs/node

What is the problem this feature will solve? It is easy to accidentally allow another user to influence what code node loads and executes. Details can be found at HackerOne reports 1564437 (CommonJS module loading), 1564444 (ECMAScript module resolution), and 1564445 (package.json). While these behaviors are documented, the security implications are easy to overlook. Insecure patterns around these

[efcl]

package.jsonとnode_modulesのセキュリティ課題