tinyNpm is a vs code extension that helps protect you from supply chain attacks, stale packages, and bloated code!
I had been using package.json version keepers for quite some time but after the big supply chain attack i thought they would be the perfect place to add in some security.
The idea is just to provide the latest package number x days old. This will help prevent most of the danger in supply in chain attacks.
It will also remove the ^ if you have it so you can better control what version of a package your application is using.
To be more security focused it gives general hints in the hover menu to help keep an eye on the packages you have installed. These hints include warnings for staleness, high dependency count, and number of downloads.
Since all of this is something you can get through the npm api, I called it tinyNpm
답글 남기기