← 피드로
Today I launched [email protected], upgrading from 0.1.0 to stable.
revera is a CLI that scores npm packages for security risk before you install them. The 1.0.0 rewrite replaces fixed weights with a Bayesian evidence engine: every package becomes a node in its dependency graph, gets scored across 8 categories from real signals (vuln feeds, publisher trust, GitHub activity, typosquat detection), and risk propagates bottom-up through the whole dependency tree, not just the top-level package.
Previously it used pre-defined weights. Now it decides its own weights from the evidence.
npm install revera
추출 본문 · 출처: dev.to · https://dev.to/aaravmaloo/releasing-revera100-2llo
답글 남기기