investigate lavamoat for supply chain attack protection
Open
Nobody has claimed this yet.
p1
refactor
- Dominant language
- TypeScript
- Stars
- 5.5k
- Forks
- 5.4k
- PR merge metrics
- No merged PRs in 30d
Description
https://github.com/LavaMoat/LavaMoat
we haven't done enough due diligence here, but if we are going to accept external prs with yarn.lock and package.json updates (or blindly upgrade ourselves), we need to figure out a way to protect users from supply chain attacks
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the Lavamoat project linked in the issue and the repository’s yarn.lock and package.json update workflow. Determine whether it can protect users from supply-chain attacks when dependencies are upgraded or external PRs are accepted. Done should be a documented due-diligence result and a clearly agreed protection approach.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100