Hacker News new | ask | show | jobs
by Cthulhu_ 680 days ago
Would you be at all surprised? I'm fairly confident that like with browser addons, NPM package maintainers get offers from randoms to 'buy' their package in order to get backdoor access.

A secured registry is long overdue, where every release gets an audit report verifying the code and authorship of a new release. It won't be nearly as fast as regular NPM package development but that's a good thing, this is intended for LTS versions for use in long-term software. It'd be a path to monetization as well, as the entities using a service like this is enterprise softare and both the author(s) of the package as the party doing the audit report would get a share.
2 comments
throwitaway1123 680 days ago
> A secured registry is long overdue, where every release gets an audit report verifying the code and authorship of a new release.

Microsoft did exactly that (since they own both NPM and Github) by allowing you to verify the provenance of NPM packages built using Github Actions [1]. It's not required for all packages though. They've also started requiring all "high impact" packages to use two factor authentication [2].

[1] https://github.blog/security/supply-chain-security/introduci...

[2] https://github.blog/changelog/2022-11-01-high-impact-package...

link
vb-8448 680 days ago
> Would you be at all surprised

Actually no, I just wonder why no one takes seriously these types of risks.

Supply chain attacks are a thing nowadays, but no one really cares, 6 months ago we had the xz attack but basically no one remember about it today.

link