Comment on Mischievous NPM PublicationsparentComments−vorticalbox3yThe trick is to change the package-lock.What you do it fork a popular package that the project uses and make some changes.Then update the package-lock so that it points to your GitHub fork.This file is normally ignored in PR due to the amount of line changes in there so you can have quite a bit of fun.−leipert3yWe‘ve been writing a tool to check lock files against the registry: https://www.npmjs.com/package/@gitlab/untamper-my-lockfileFor now it only supports yarn, but npm support shouldn’t be too hard.−louislang3yThis is really cool work, glad to see someone tackling this! Can I assume this will get rolled out into gitlab natively?−leipert3yActually good point, will talk to the respective PMs next week. Mainly been using it in CI in order to protect our own projects (thus yarn only for now)
Comments
The trick is to change the package-lock.
What you do it fork a popular package that the project uses and make some changes.
Then update the package-lock so that it points to your GitHub fork.
This file is normally ignored in PR due to the amount of line changes in there so you can have quite a bit of fun.
We‘ve been writing a tool to check lock files against the registry: https://www.npmjs.com/package/@gitlab/untamper-my-lockfile
For now it only supports yarn, but npm support shouldn’t be too hard.
This is really cool work, glad to see someone tackling this! Can I assume this will get rolled out into gitlab natively?
Actually good point, will talk to the respective PMs next week. Mainly been using it in CI in order to protect our own projects (thus yarn only for now)