Man that’s clever

[DO NOT DEVELOP MY APP]

The really scary thing is probably the malicious npm dependencies. If I think about the projects at work with and all the different packages and the hundreds of dependencies no one knows. And it's probably even worse in really big companies like Microsoft or Facebook, they probably got thousands across their products. I hope for us all that they scan them very regularly.

There goes the argument of non technical users falling for scams. The tables have turned!

I do wonder if this would be negated by containered applications

Oo that's a sneaky one, very impressive.

Examine dependencies and installation scripts. Very recently published, net-new packages, or scripts or dependencies that make network connections during installation should receive extra scrutiny.

I'm a little surprised npm doesn't already do this and give you a big blinking warning in the install process about it.

How do Linux distro's deal with this? I feel like however that's done, I'd like node packages to work in a similar way - "package distro's". You could have rolling-release, long-term service w/security patches, an application and verification process for being included in a distro, etc.

It wouldn't eliminate all problems, of course, but could help with several methods of attack, and also help focus communities and reduce duplication of effort.