Repository navigation
Did all dependencies been reviewed for security? #213
Description
Activity
Hi 👋
Generally, we depend on the Dependabot alerts to patch security vulnerabilities for the npm package dependencies. Also, we had reviewed the dependencies when we created this repository (~ like two years ago)
The one in the devDependencies was published 5 years ago, and maintained by 1 developer.
This ^ definitely won't be caught by it.
I wonder if we should start doing a bi-monthly security review or engage some tooling to help us with it. Any ideas are appreciated.
Brigit Murtaugh (@bamurtaugh) Craig Peters (@craiglpeters) Looking for your insights 👀Thanks!
This ^
I'm not expert of npm, but I guess it's not secure for important projects:
...even locked:
Also, "unused dependency" may insecure, see
ignore-scriptson https://cheatsheetseries.owasp.org/cheatsheets/NPM_Security_Cheat_Sheet.html
For example, I noticed there're two jsonc related dependencies:
action/package.json
Line 34 in a1930bf
action/package.json
Line 46 in a1930bf
The one in the devDependencies was published 5 years ago, and maintained by 1 developer.
I know it's not been used in the source code yet, but I'm curious about how the supply chain security works there.
Thanks :)