← Back to context

Comment by jacquesm

4 days ago

Nobody - and I mean absolutely nobody - using Node.js has fully audited all of the dependencies they use and if we find somewhere in a cave a person that did that they are definitely not going to do it all over again when something updates.

9 comments

jacquesm

Reply
cluckindan  4 days ago

I can guarantee that any financial institution which has standard auditing requirements and is using Node.js has fully audited all of the dependencies they use.

Outside that, the issue is not unique to Node.js.

  • jacquesm  4 days ago

    Sorry, but that had me laughing out loud.

    No, they haven't.

    I should know, I check those companies for a living. This is one of the most often flagged issues: unaudited Node.js dependencies. "Oh but we don't have the manpower to do that, think about how much code that is".