you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 6 months ago (3 children)

That sounds more like bad practices from the community. It definitely has ways to use exact versions. Not the least of which the lock file. Or the shrinkwrap file which public packages should be using.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 7 points 6 months ago (1 child)

    Any security system based on expecting good behavior from people is sure to fail. If NPM has no estructural features to enforce safe behaviors, it is vulnerable by default. As no person using it will apply safe practices unless forced to. Specially if the default, easiest, less friction behavior, is inherently unsafe.

  • source
  • parent
  • hideshow 1 child comment