[TheDong]

> what if one of your contributors slips in a merge that uses the vulnerable code path of your dependency

If your threat model is a contributor submitting malicious code, your problem is not something npm audit will help with either way.

If a malicious actor is able to add the "not affected" marker, you have bigger problems.

The threat model you're talking about neither seems realistic, nor like something npm audit can help with. The attack vector of a contributor sneaking in malicious code is dealt with by only giving the commit bit to trusted people, and reviewing code yourself.

[cphoover]

> The threat model you're talking about neither seems realistic, nor like something npm audit can help with. The attack vector of a contributor sneaking in malicious code is dealt with by only giving the commit bit to trusted people, and reviewing code yourself.

How is this not realistic when it has already been seen in the npm ecosystem multiple times. For an example of this in the wild see the event-stream (crypto-mining trojan) fiasco: https://github.com/dominictarr/event-stream/issues/116

Dependencies are a target for exploit, your package may be safe now and then become unsafe in the future, either intentionally or unintentionally.

[enumjorge]

The problem is, if a security vulnerability snaked past the maintainers of a project, what hope do I have as someone who consumes the package to a) catch it b) know how to fix it?

[cphoover]

That's exactly the issue that npm-audit seeks to ameliorate. It's not perfect, but it's better than nothing.