7 ms·
This won’t protect against everything, but it still seems like a good idea to implement: https://github.com/danielroe/provenance-action https://github.com/dani
by retlehs 1y ago
This won’t protect against everything, but it still seems like a good idea to implement:
https://github.com/danielroe/provenance-action https://github.com/danielroe/provenance-action
- indigodaddy 1y agoYep I did see that, but I'm not planning on pushing anything, just want a tool to scan for any of the offending packages. Could make my own but feel like somebody must have already made something (and probably better than I can)
- dflock 1y ago- [supply-chain-security · GitHub Topics · GitHub](https://github.com/topics/supply-chain-security https://github.com/topics/supply-chain-security) - [GitHub - safedep/vet: Protect against malicious open source packages](https://github.com/safedep/vet https://github.com/safedep/vet) - [GitHub - AikidoSec/safe-chain](https://github.com/AikidoSec/safe-chain https://github.com/AikidoSec/safe-chain) - npm audit
- indigodaddy 1y agovet and safe-chain look good thanks! I'm just dabbling with Node only (no experience really), so haven't used npm audit but will see how that works too. Appreciate the links.