Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Did all dependencies been reviewed for security? #213

Open
hellodword opened this issue Feb 15, 2024 · 2 comments
Open

Did all dependencies been reviewed for security? #213

hellodword opened this issue Feb 15, 2024 · 2 comments

Comments

@hellodword
Copy link
Contributor

For example, I noticed there're two jsonc related dependencies:

"jsonc-parser": "^3.2.0"

"jsonc": "^2.0.0",

The one in the devDependencies was published 5 years ago, and maintained by 1 developer.

I know it's not been used in the source code yet, but I'm curious about how the supply chain security works there.

Thanks :)

@samruddhikhandale
Copy link
Member

samruddhikhandale commented Feb 24, 2024

Hi 👋

Generally, we depend on the Dependabot alerts to patch security vulnerabilities for the npm package dependencies. Also, we had reviewed the dependencies when we created this repository (~ like two years ago)

The one in the devDependencies was published 5 years ago, and maintained by 1 developer.

This ^ definitely won't be caught by it.

I wonder if we should start doing a bi-monthly security review or engage some tooling to help us with it. Any ideas are appreciated.
@bamurtaugh @craiglpeters Looking for your insights 👀

@hellodword
Copy link
Contributor Author

Thanks!

This ^

I'm not expert of npm, but I guess it's not secure for important projects:

...even locked:

Also, "unused dependency" may insecure, see ignore-scripts on https://cheatsheetseries.owasp.org/cheatsheets/NPM_Security_Cheat_Sheet.html

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants