Hi!
I was wondering if we could upgrade to require NPM v12 for deployment and development since it blocks all lifecycle scripts by default.
I think this (hopefully) wouldn't be too complicated to set up (it's basically devEngines, engines and allowing trusted dependencies) and would be really good especially for developers since it's well-known there's a lot of malware on NPM using lifecycle scripts (it's unfortunately the easiest way to install malware, it can run any arbitrary code on npm install and it just takes one bad dependency in the dependency graph for this to happen).
And if a developer of this project with elevated privileges gets malware then the whole project could be compromised, so it's really for the security of the whole project.
I would be more than happy to try and get a PR up to solve this since I'm looking to start contributing to the Unlayer projects! Just let me know if I should proceed.
Thanks!
Hi!
I was wondering if we could upgrade to require NPM v12 for deployment and development since it blocks all lifecycle scripts by default.
I think this (hopefully) wouldn't be too complicated to set up (it's basically
devEngines,enginesand allowing trusted dependencies) and would be really good especially for developers since it's well-known there's a lot of malware on NPM using lifecycle scripts (it's unfortunately the easiest way to install malware, it can run any arbitrary code onnpm installand it just takes one bad dependency in the dependency graph for this to happen).And if a developer of this project with elevated privileges gets malware then the whole project could be compromised, so it's really for the security of the whole project.
I would be more than happy to try and get a PR up to solve this since I'm looking to start contributing to the Unlayer projects! Just let me know if I should proceed.
Thanks!