Comment by bodash
4 days ago
I compiled a list of NPM best practices one can adopt to reduce supply chain attack risks (even if there's no perfect security preventions, _always_): https://news.ycombinator.com/item?id=45326754
4 days ago
I compiled a list of NPM best practices one can adopt to reduce supply chain attack risks (even if there's no perfect security preventions, _always_): https://news.ycombinator.com/item?id=45326754
For anyone publishing packages for others to use: please don't pin exact dependency versions. Doing so requires all your users to set "overrides" in their own package.json when your dependencies have vulnerabilities.
I have a shorter list of NPM best practices:
1. Don't
Do you know of anything similar for pip?
No.1: Run untrusted code in a sandbox! https://github.com/sandbox-utils/sandbox-venv
Most of the best practices can be translated to python ecosystem. It’s not exact 1:1 mapping but change few key terms and tools, the underlying practices should be the same.
Or copy that repo’s markdown into an llm and ask it to map to the pip ecosystem
Yeah, was mostly interested in the tooling.