Supply chain attacks

[kapouer]

Hi,
unless mistaken, the current configuration of this project doesn't actively try to guard against such attacks.
One could:

• disallow all dependencies to execute their postinstall scripts
• disallows updating lock file with dependencies that have been released only a few days ago (npm, pnpm, yarn support that)
• could audit dependencies as part of github actions (npm audit)

Each of these can be addressed, without much effort, and would raise the protections against such attacks, which are quite common nowadays.

I raised a very similar issue at "notion", for example, and it became this:
outline/outline#12170

[rathlinus]

i will take a look at it tomorrow

[kapouer]

Thanks. Mind that I'm not going on a campaign, I will, from time to time, try to summon best security practices w.r.t. dependencies on projects I feel it's more important than ever.