6 ms·
Those dependencies, many probably written by unknown authors with 0 stars on github, have complete access to your computer and can execute arbitrary code. Even
by frankpf 7y ago
Those dependencies, many probably written by unknown authors with 0 stars on github, have complete access to your computer and can execute arbitrary code. Even though it shouldn't affect production, that's still a big problem for your own machine.
To put it another way, would you willingly download and execute 730 programs from unknown authors on your computer?
- throwthisaway2 7y agoYes , we all do, all the time. This is web dev since node came around.
- chiefalchemist 7y agoSpitballing...couldn't there be a cloud-based Bundler as a Service? Mind you, there's a risk in letting someone else "see" your code, having 700+ applications of unknown origin isn't any better. If the host of the BaaS could be trusted, and they constantly vetted all packages, isn't that possibility less risky?
- komali2 7y agoI might be missing something here, but that cloud based service would either need to run webpack, roll-up, or parcel on the files you send them, or write a new application from scratch (without dependencies). I guess businesses are gonna business but if you're writing that application anyway why not just release it for devs to run on their own machines and ci servers?
- chiefalchemist 7y agoYes. Same flow/process. The difference is, the service provider vets the packages. Certainly, given the risks, there's a market at the enterprise level. Sec for them is real.
- zelphirkalt 7y agoEspecially with minified JS, how would you be sure, that you get a minified version of your actual code and not one, which does something else additionally, which you might not want? Not saying, that running 700+ apps is better, just noting, that bundling as a service might not be a perfect solution either.
- filoleg 7y agoWhat about bundling in a local VM or docker container?
- brulard 7y agoI believe there could be some malicious code added to the bundle by these dependencies regardless of where it is being run
- filoleg 7y agoI was mostly addressing the part regarding malicious dependencies gaining access to your local filesystem. If we are talking about the final bundle itself being compromised, there is not really a technical solution to that other than not using dependencies.
- city41 7y agoThis is a systemic problem with JS dev in general. I know of zero projects that keep the number of dependencies low enough to enable manual audit. Pretty much everyone out there is blindly installing hundreds, and often thousands, of packages, no matter what setup they choose.
- TheRealPomax 7y agoThat's a universal dependency problem, and is why you're advised to always run a not-a-throwaway-project with vulnerability monitors. Heck, if you use something like Github, you even get that for free these days.