Things which could help against NPM supply chain attacks similar to one which happened today: - prefer specific pkg versions instead of ranges (2.0.0 not ^2.0.0) - prefer rare dep updates (once per 3mo or so) For pkg authors: - publish from github ci - do not store npm tokens on a dev machine - while publishing from github ci, enable provenance for transparency & pin workflow hashes (fresh policy)
- 6 replies
- 7 recasts
- 54 reactions
Releasing noble cryptography v2. Time to make JS ecosystem safer once again. Lots of changes. Details below👇
- 5 replies
- 13 recasts
- 62 reactions
Releasing micro-zk-proofs: JS library to create and verify zk-SNARK proofs. Proofs are created in parallel using Web Workers. Noble cryptography is utilized underneath. During development of zkp, a vulnerability was found in wasmsnark, alternative proof generation library.
- 6 replies
- 14 recasts
- 76 reactions