Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FEATURE] Recent update warning #81

Open
wants to merge 5 commits into
base: master
Choose a base branch
from

Conversation

IchiiDev
Copy link

This feature was suggested by Issue #80, I have implemented it on my fork.
What has been asked is basically to add a warning if a package was pushed recently, to prevent package hijacking and malwares.

What I have done to implement it:

  1. Everytime a dependency is prompted, it will fetch https://registry.npmjs.com/:package to fetch the version's publication date
  2. Will check if 3 days have passed since the last publish
  3. If not then it will throw an error, a warning or an info telling the user the package was pushes recently and that they should be careful when upgrading.

This has been tested with some recently pushed packages and it works as expected. I will be available during the next few days to edit if any review requires changes.

@houd1ni
Copy link

houd1ni commented Dec 31, 2022

hi, @IchiiDev !
PRs here are quite stuck, hence maybe make an independent project began from the fork ? Seems that this one could be a nice start.
I have a huge issue when being at bad network environments and almost cannot npm-upgrade at all, therefore willin' to commit some code into there asap.

@IchiiDev
Copy link
Author

I'm going to send an email directly to @th0r to suggest giving ownership/management to someone else, both on the NPM registery and GitHub. If no answers ensues I will try and send a ticket to NPM's support to request ownership due to inactivity. 😄

@houd1ni
Copy link

houd1ni commented Dec 31, 2022

I'm going to send an email directly to @th0r to suggest giving ownership/management to someone else, both on the NPM registery and GitHub. If no answers ensues I will try and send a ticket to NPM's support to request ownership due to inactivity. 😄

Nice! Tag me here, please, with any news!

@houd1ni
Copy link

houd1ni commented Jan 14, 2023

@IchiiDev salut! Any news ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants