5 ms·
NPM Package Provenance (2023)
- behindsight 1y agoReminder, you can audit all your npm packages to see if they provide provenance attestation with: npm audit signatures you can use this to also provide a gentle reminder to package authors to consider setting one up (or replacing those that can't/won't) Additional resources: - Trusted publishing via OIDC [1] - Requiring 2FA for package publishing [2] 1: https://docs.npmjs.com/trusted-publishers https://docs.npmjs.com/trusted-publishers 2: https://docs.npmjs.com/requiring-2fa-for-package-publishing-and-settings-modification https://docs.npmjs.com/requiring-2fa-for-package-publishing-...
- codedrift_ 1y ago> To achieve this, we require that packages are built on a trusted CI/CD platform Given what happened with NX [1], I'm hoping GitHub Actions disallows certain types of commands in their YAML. Otherwise we still have a straightforward way to attach provenance to malicious code. =\ 1: https://x.com/adnanthekhan/status/1958722939534417989 https://x.com/adnanthekhan/status/1958722939534417989