6 ms·

What about services like npm that distribute code? Are these analogous or do they have additional security in place?

• jacquesm 11y ago
  Isn't that server side?
  • Zikes 11y ago
    With dependency resolution and node_modules folders dozens of levels deep, it's pretty difficult to verify untrusted code hasn't been injected somewhere.
  • hexasquid 11y ago
    Not really. NPM is also used with a tool called browserify to enable frontend web developers to use NPM modules in the browser.
  • ktusznio 11y ago
    Yes, but the same attack could happen if an attacker gains control of an npm module. Users without tight control over their modules could unwittingly pull in malicious code.