<story><title>Embedded Malicious Code in node-ipc</title><url>https://github.com/advisories/GHSA-97m3-w2cp-4xx6</url></story><parent_chain><item><author>davidmurdoch</author><text>I maintain what is probably the most popular Ethereum simulator (Ganache) and it uses the npm ecosystem.&lt;p&gt;Years ago I chose to pin&amp;#x2F;lock all dependencies, even transitive dependencies (direct dependencies&amp;#x27; dependencies) to much disagreement from the semver purists.&lt;p&gt;Crypto developers are extra high value targets because they likely access their wallet from the same machine they develop on. So I&amp;#x27;ve taken a very hard stance on this, even feel we should do even better by disallowing updates for new releases (I realize adequate security here is not practical&amp;#x2F;feasible for most).&lt;p&gt;To make matters worse: devs often install npm packages with sudo (and I have a canned response for sudo related issues telling them that they must now format their drives to fix it, and even that might not be enough as their bios and other embedded firmware could also be compromised).&lt;p&gt;Meanwhile, yarn, a popular npm alternative, will NOT respect a package author&amp;#x27;s wishes to lock transitive dependencies. It&amp;#x27;s maddening (don&amp;#x27;t use yarn until&amp;#x2F;unless they fix this).&lt;p&gt;The only time a dependency shouldn&amp;#x27;t be pinned is if you are also the author of that dependency.&lt;p&gt;Anyway, people would say I&amp;#x27;m fun at parties, but they stopped inviting me long ago.</text></item></parent_chain><comment><author>lstamour</author><text>My preferred fix for Yarn dependency tracking is to use zero installs[1] as there is no command to run and dependencies can be exactly what ships in the repo and nothing more (with the right flags). If accepting PRs from third-parties, the check-cache flag can run in CI to validate checksums from untrusted contributors — plus, you know, reading dependency source code when you have the time or reason to do so would be great within a PR review also.&lt;p&gt;I wish more tools were able to concisely show you the differences between dependencies, but… sometimes dependencies have binaries and at that point you might need to fork or clone and build your own version of a dependency. I’d suggest only using dependencies when you can read and understand the code, but there are always limits. I can’t think of the last time I thought of a glibc dependency except when using Alpine or compiling something for Cgo. But it’s still something to keep in mind: that sometimes your project will be simpler and easier with fewer, smaller dependencies where you can read the code in full.&lt;p&gt;1: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;yarnpkg.com&amp;#x2F;features&amp;#x2F;zero-installs#does-it-have-security-implications&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;yarnpkg.com&amp;#x2F;features&amp;#x2F;zero-installs#does-it-have-secu...&lt;/a&gt;</text></comment>
<story><title>Embedded Malicious Code in node-ipc</title><url>https://github.com/advisories/GHSA-97m3-w2cp-4xx6</url></story><parent_chain><item><author>davidmurdoch</author><text>I maintain what is probably the most popular Ethereum simulator (Ganache) and it uses the npm ecosystem.&lt;p&gt;Years ago I chose to pin&amp;#x2F;lock all dependencies, even transitive dependencies (direct dependencies&amp;#x27; dependencies) to much disagreement from the semver purists.&lt;p&gt;Crypto developers are extra high value targets because they likely access their wallet from the same machine they develop on. So I&amp;#x27;ve taken a very hard stance on this, even feel we should do even better by disallowing updates for new releases (I realize adequate security here is not practical&amp;#x2F;feasible for most).&lt;p&gt;To make matters worse: devs often install npm packages with sudo (and I have a canned response for sudo related issues telling them that they must now format their drives to fix it, and even that might not be enough as their bios and other embedded firmware could also be compromised).&lt;p&gt;Meanwhile, yarn, a popular npm alternative, will NOT respect a package author&amp;#x27;s wishes to lock transitive dependencies. It&amp;#x27;s maddening (don&amp;#x27;t use yarn until&amp;#x2F;unless they fix this).&lt;p&gt;The only time a dependency shouldn&amp;#x27;t be pinned is if you are also the author of that dependency.&lt;p&gt;Anyway, people would say I&amp;#x27;m fun at parties, but they stopped inviting me long ago.</text></item></parent_chain><comment><author>bushbaba</author><text>It&amp;#x27;s maddening the crypto world relies on Javascript so heavily. As a language it would never be my first, second, or even third choice for financial services.</text></comment>