verdaccio VS cli

do you know the project https://github.com/verdaccio/verdaccio

Verdaccio allows to setup a private proxy registry for Node.js

Verdaccio does okay for this

There’s also this: https://www.npmjs.com/package/verdaccio

Cool! What makes Package Depot better than existing solutions such as verdaccio?

I highly recommend using a package proxy like https://github.com/verdaccio/verdaccio instead of git submodules if you have more then one developer using your code/repo. Biggest factor is the cost of the developers time. Why teach them a different way to install dependancies when there is a standard way of doing things your CI/CD is simplified, the knowledge of git submodules is good to know, but this is now tribal knowledge on how to setup this up, update dependancies, etc...

The goal of verdaccio is to make this less complicated. https://github.com/verdaccio/verdaccio

📢 By the way NodeSecure CLI has a first-class support of the scorecard.

Those information are visible in the NodeSecure CLI interface:

@nodesecure/cli, a CLI that allow you to deeply analyze the dependency tree of a given package or local Node.js project

Fun fact: its first contribution 🐤 on NodeSecure was also on the old version of the code Scanner that managed vulnerabilities.

When NodeSecure was a single project the AST analysis was at most a few hundred lines in two or three JavaScript files. All the logic was coded with if and else conditions directly in the walker 🙈.

View on GitHub

NodeSecure can now detect packages created by Marak and it will generate a global warning ⚠️.

After more than ten long months of work we are finally there 😵! Version 0.9.0 has been released on npm 🚀.

Nsecure