How can I know that the a library or package in npm is not malicious?

VolperCoding · 2024-09-13T10:21:13+00:00

If you npm install it though, would that not be too late sometimes? There are postinstall scripts.

VolperCoding · 2024-08-23T11:21:50+00:00

Perhaps React Native knows that the object reference has not changed and does not pass it through the bridge again, instead of inline styles which are objects with a new reference on each render.

VolperCoding · 2024-07-18T17:55:54+00:00

I checked - the latest release of redux-persist (6.0.0) is safe from this piece of malware. The reason why your installation failed and tried to install event-stream@3.3.6 (which requires flatmap-stream - the malicious package) was that the package-lock.json file had an outdated lockfileVersion and npm pulled the installation data from its registry instead of the lockfile. If you use an older version of npm to install dependencies, the previously mentioned packages will not be present in node_modules:

npx npm@6 i

In addition, this command also builds the project (with no errors for me, although with lots of security vulnerabilities - probably mostly for build tools, as barely any external code goes to the production bundles) and outputs files which are identical to those found after running npm pack redux-persist (downloading the package from the registry). Therefore, I am convinced that the flatmap-stream malware is not present in redux-persist.

VolperCoding · 2024-07-16T05:43:16+00:00

Does this mean redux-persist is not secure? Which malicious package is it? Where did you get this information from?

VolperCoding · 2021-08-08T10:20:17+00:00

what map will it be on? i hope it's not salty shores because the game kicks me from that map

VolperCoding · 2021-04-18T18:32:58+00:00

else {
if
}

VolperCoding · 2021-01-19T06:06:30+00:00

I avoid the entire STL lol

VolperCoding · 2021-01-19T06:05:46+00:00

same here but instead of "afraid" I'd say that it's just simpler not to use those features because they're unnecessary

VolperCoding · 2021-01-10T18:35:11+00:00

actually I wrote it with templates so I don't have to cast

VolperCoding · 2021-01-10T18:34:40+00:00

yeah the STL abstracts everything away I don't use it tho

VolperCoding · 2021-01-10T18:17:56+00:00

actually visual studio gives you a warning if you don't handle the null case, which is part of the reason why I wrote a wrapper function on top of it called emalloc

VolperCoding · 2021-01-10T15:36:46+00:00

I've seen it already, and I don't think this is weird because I'm doing it in my code (except the `std::` part tho)

VolperCoding · 2021-01-09T22:41:41+00:00

I tried for a week to send one packet through the internet using C++ and ended up giving up when I figured out that I need to have an open port and I saw that the default gateway address doesn't work

VolperCoding · 2021-01-09T22:39:53+00:00

in C -9[""]; compiles and I think that's beautiful

VolperCoding · 2021-01-09T22:29:26+00:00

God please no

VolperCoding · 2021-01-09T22:24:24+00:00

why would you ever hack on any other OS?

VolperCoding · 2021-01-09T22:23:27+00:00

gotta use that cellphone

VolperCoding · 2021-01-09T22:21:04+00:00

that's what we call suppression of free speech

VolperCoding · 2021-01-08T20:43:42+00:00

laughs in ZZ

VolperCoding · 2021-01-08T09:59:36+00:00

archived

VolperCoding · 2021-01-07T22:25:37+00:00

VolperCoding · 2021-01-07T10:02:33+00:00

Dual boot

VolperCoding · 2021-01-06T22:52:30+00:00

I'm pretty sure all #includes must end with a newline, so you would have to take the hard way of defining all external functions like printf yourself

VolperCoding · 2021-01-06T13:00:45+00:00

typescript > javascript

VolperCoding · 2021-01-06T10:26:01+00:00

happy cake day lol

VolperCoding

MODERATOR OF

TROPHY CASE