Socket.dev: Blocking Malicious Package Behavior at Dependency-Diff Time
Socket.dev goes beyond CVEs by analyzing install scripts, obfuscation, network and shell access, and ownership changes when packages enter a dependency diff.
#npm
2 postsFalse positives in Node.js image vulnerability scans? Separate app packages from npm built-ins first
When reviewing vulnerability scan results for a Node.js Docker image, you can't just look at package names. First distinguish between project dependencies and the packages bundled with npm inside the base image — otherwise you'll fix the wrong thing.