snync
snync copied to clipboard
Mitigate security concerns of Dependency Confusion supply chain security risks
We have a nightly audit check where we run `npx snync -d .`. Since last night this call started failing with the following error report: ``` Checking dependency: classnames SyntaxError:...
So, a couple of things here: 1. If the package is scoped, we don't tell the user anything about it now, we just silently skip them. 2. We don't check...
Currently, the CLI outputs the following results for a scan: ``` ❯ npx snync --directory . --private "superlaser" npx: installed 68 in 6.711s Testing project at: /Users/lirantal/projects/repos/dependency-confusion-demo/packages/new-project Reviewing your dependencies......