loopbackio / loopbackio/security
Add lockfile validation
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 4
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
Lockfiles are generally treated as an opaque format, and as such are typically ignored during code review. However, they can be an attack vector if they are modified to download malicious packages instead. This is because lockfiles only check for integrity but not authenticity.
lockfile-lint is a project maintained by a Snyk staff which can notably enforce the permitted hosts and URL schemes within NPM and Yarn lockfiles.
This issue is to track adding of lockfile-lint to our Git Repositories.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No repository files or tests are named. Start by reviewing how the Git repositories are configured and the lockfile-lint project, focusing on its support for NPM and Yarn lockfiles and permitted hosts and URL schemes. Done means lockfile-lint is added to the relevant repositories with validation enabled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100