How to respond to growing supply chain security risks?

• rfcs

  35 716 5.6 JavaScript

  Public change requests/proposals & ideation (by npm)

  

I started following this problem from the discussion at npm about making install scripts opt-in. But install scripts are not the only threat, there are more ways for malicious actors:

• sdc-check

  2 138 3.8 TypeScript

  Small tool to inform you about potential risks in project dependencies list

Also, try to adopt tools like sdc-check or scanner or something else as your additional safety step.

• SurveyJS

  surveyjs.io sponsored

  Open-Source JSON Form Builder to Create Dynamic Forms Right in Your App. With SurveyJS form UI libraries, you can build and style forms in a fully-integrated drag & drop form builder, render them in your JS app, and store form submission data in any backend, inc. PHP, ASP.NET Core, and Node.js.

  

• scanner

  4 27 8.0 JavaScript

  ⚡️ A package API to run a static analysis of your module's dependencies. This is the CLI engine! (by NodeSecure)

  

And it is happening right now. Github is opening the GitHub Advisory Database to community submissions. Awesome community NodeSecure builds cool things like scanner and js-x-ray. There are also lockfile-lint, LavaMoat, Jfrog-npm-tools (and I am sure there is more).

• js-x-ray

  8 195 8.7 JavaScript

  JavaScript & Node.js open-source SAST scanner. A static analyser for detecting most common malicious patterns 🔬.

  

And it is happening right now. Github is opening the GitHub Advisory Database to community submissions. Awesome community NodeSecure builds cool things like scanner and js-x-ray. There are also lockfile-lint, LavaMoat, Jfrog-npm-tools (and I am sure there is more).

• lockfile-lint

  5 767 7.6 JavaScript

  Lint an npm or yarn lockfile to analyze and detect security issues

And it is happening right now. Github is opening the GitHub Advisory Database to community submissions. Awesome community NodeSecure builds cool things like scanner and js-x-ray. There are also lockfile-lint, LavaMoat, Jfrog-npm-tools (and I am sure there is more).

• LavaMoat

  16 810 9.8 JavaScript

  tools for sandboxing your dependency graph

  

And it is happening right now. Github is opening the GitHub Advisory Database to community submissions. Awesome community NodeSecure builds cool things like scanner and js-x-ray. There are also lockfile-lint, LavaMoat, Jfrog-npm-tools (and I am sure there is more).

Suggest a related project