Nodebestpractices: 'npm security best practices' is a great source for additional security bullets
Great article by @lirantal here: "npm security best practices"
Some of the ideas there might be a great addition to our guide, we may include with Credit, what do you think @js-kyle ?
goldbergyoni
All 6 comments
Amazing work! Yes definitely
js-kyle
on 24 Feb 2019
I'd be happy if you include credits and reference to the cheat sheet ;-)
@js-kyle if something is unclear or you'd want to consult more you're welcome to tag me
lirantal
on 25 Feb 2019
I think 3.Minimize attack surfaces by ignoring run-scripts would be good to add here
js-kyle
on 26 Feb 2019
@lirantal Wouldn't this (ignore run-scripts) break some packages that rely on scripts?
@js-kyle Maybe bullet number 1 (use .npmignore or files) is less controversial?
goldbergyoni
on 3 Mar 2019
@lirantal Wouldn't this (ignore run-scripts) break some packages that rely on scripts?
Yep, and at the same time protect you from evil execution in install phases.
lirantal
on 4 Mar 2019
Hello there! 👋
This issue has gone silent. Eerily silent. ⏳
We currently close issues after 100 days of inactivity. It has been 90 days since the last update here.
If needed, you can keep it open by replying here.
Thanks for being a part of the Node.js Best Practices community! 💚
![stale[bot] picture](https://avatars3.githubusercontent.com/in/1724?v=4&s=40)
stale[bot]
on 2 Jun 2019
Related issues
bikingbadger
·
6Comments
mcollina
·
3Comments
YukiOta
·
3Comments
goldbergyoni
·
6Comments
noway
·
3Comments
Most helpful comment
I'd be happy if you include credits and reference to the cheat sheet ;-)
@js-kyle if something is unclear or you'd want to consult more you're welcome to tag me