Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Preventing prototype pollution in your repository

aikido.dev | blog | #cloud | #rce | #remediation | #npm | #prototype-pollution | #cve | #aikido | #javascript | #nodejs

Summary

Prototype pollution causes 20-30% of CVEs in JavaScript/npm stacks and can lead to RCE. The article covers why Node's --frozen-intrinsics isn't ready and how the nopp library mitigates it.
Published
Collected

original ↗

Related coverage

  1. The CVE spike across major software companies is a remediation problem (aikido.dev)
  2. Good riddance, TeamPCP. Now for the hard part. (aikido.dev)
  3. Shai-Hulud was the best thing to happen to supply chain security (aikido.dev)
  4. Where Severity Scores Go Wrong: “Just Add Prototype Pollution” (jfrog.com)
  5. When JavaScript Chunks Become Keyholes to the Cloud (labs.cognisys.group)
  6. Popular code generator for TanStack Query hit by supply chain worm (aikido.dev)

back