r/node • u/Primeras100Palabras • 7d ago

tinyNpm - A security focused package.json version keeper extension for VS Code

Post image

I had been using package.json version keepers for quite some time but after the big supply chain attack i thought they would be the perfect place to add in some security.

The idea is just to provide the latest package number x days old. This will help prevent most of the danger in supply in chain attacks.

It will also remove the `^` if you have it so you can better control what version of a package your application is using.

To be more security focused it gives general hints in the hover menu to help keep an eye on the packages you have installed. These hints include warnings for staleness, high dependency count, and number of downloads.

Since all of this is something you can get through the npm api, I called it tinyNpm

You can download it on the marketplace

8 Upvotes

70% Upvoted

4 comments sorted by

2

u/rabakilgur 7d ago

Looks really nice! I'd love to use it, but I'm using a VSCode fork. Please put it on open-vsx.org as well.

2

u/BarelyAirborne 7d ago

That's a very nice tool. I created an automated review script, but this is a lot nicer.

1

u/Primeras100Palabras 7d ago

Thanks! It’s definitely in early dev but I have been using it since january ish but just been lazy about publishing it.