Skip to content

Latest commit

 

History

History
23 lines (20 loc) · 1.21 KB

2021-02-11-npm-and-dependency-confusion copy.md

File metadata and controls

23 lines (20 loc) · 1.21 KB
Raw
title date tags draft summary
NPM and Dependency Confusion
2021-02-11
npm
security
false
Do you manage a private registry? Here's a policy to keep your apps safe from Dependency Confusion.

You may have recently read about the exploits around dependency confusion.

I manage our NPM Repository at work. I was already aware of this particular issue with NPM scopes, and had prepared our development teams to handle this kind of exploit. The policy I implemented can be found below.

  • All internal projects must use a lockfile.
    • All new development will generate a lockfile anyway.
    • Legacy projects should be updated prior to any new feature work.
  • All internal packages must use a scope.
    • Attempts to install/publish packages without a scope should be rejected.
  • All internal project scopes must also be registered on public registries.
    • The easiest way to ensure this is to lock down scope generation.
  • No packages can use internal scopes for open source projects. Different registries should always use different scopes.
    • This is just a good practice with NPM in general, since a package can only use one registry per scope.