Hello! In the last post, we started looking at the important issue of security in npm and talked about what measures the company uses to identify and prevent threats. This time I want to talk about the tools and approaches that are available to you personally, and which I highly recommend that all developers implement in their practice.
Installation scripts
npm install
(: preinstall
, install
/postinstall
), . , . , , .
, :
: npm install malicious-package
, evil.sh, unix-.
, , 2018eslint-scope
eslint-config-eslint
, , .
, , , , , .
, npm npm, . , npm registry , , , , npm .
, , , , . , , .
, :
npm install suspicious-package --ignore-scripts
, ( .npmrc
):
npm config set ignore-scripts true
, . , .
, , npm, npm install
. , Docker-, . , npm root-; , . . : npm, .
: - , . , . npm.
: , . , npm .npmrc
, .
npm - (, CI/CD), . , , read-only, . .
npm IP- (CIDR). IP ( IP) . , , (on-demand). , , .
.npmrc
, (Git). NPM_TOKEN
( ).
--read-only
— , (. . , );--cidr=<CIDR>
— , IP. CIDR, IP. :--cidr=192.0.2.0/24
.
, npm-, . npm, npm token list
.
, npm adduser
.npmrc
. .
~/.npmrc
:
//registry.npmjs.org/:_authToken=00000000-0000-0000-0000-000000000000
npm registry, .
, ~/.npmrc
unix-!
(, SSH), , . , . . , . SSH, EdDSA
. , . : Ed25519
(EdDSA
) RSA
( 2048 ) .
, , . . , , npm install packae-name
: 404, — .
npm , . , , , copy-and-paste.
, , :
- , . (16 );
- . ;
- ;
- , .
: . KeePass ( ). -, . -, , , . (., Google Drive DropBox), .
, , !
(MFA)
, . . : - , . - SMS- . , . . .
, npm -. : « » « ». « », . . , npm OTP npm adduser
, - (, npm publish
).
, npm 2FA, . : , QR-, -. , CLI :
npm profile enable-2fa auth-and-writes
— « » ()npm profile enable-2fa auth-only
— « »
CLI npm ( ), QR-. (OTP), , .
npm , , , .
, , 2FA npm profile disable-2fa
, . , , npm (, ).
, npm publish
, npm .
.git
CVS
.svn
.hg
.lock-wscript
.wafpickle-N
.*.swp
.DS_Store
._*
npm-debug.log
.npmrc
node_modules
config.gypi
*.orig
package-lock.json
- registry , , , . . npm - , , .
, files
package.json
. , ( glob), . , - .
, , files
:
package.json
README
CHANGES
,CHANGELOG
,HISTORY
LICENSE
,LICENCE
NOTICE
- ,
main
README
, CHANGES
, LICENSE
NOTICE
.
, .
, npm publish
, --dry-run
npm pack --dry-run
. , , . --dry-run
, , , .
, , npm-. — .
, , , , . , .
- , , .
.