I’m following the odin project to learn web development. I had read about malicious packages in npm multiple times, so I avoided it until now. I’m on the webpack lesson now, and to use webpack, I need to install it using npm. I also see that it has many dependencies, and those dependencies will have other depenedencies and so on.
Why is it like this? Is there any other tool like webpack that doesn’t require npm? Or rather, can someone clarify how to properly use npm or link a guide that explains it? I have this kind of fear and reluctance about using npm after all the things I read.
You shouldn’t eat candy given to you by strangers. If you’re in a large group and someone knows the candy, maybe. Code is food for your computer. Be wary. Our large Open Source group of friends has learned about many kinds of candy and shouts loudly when some in the group becomes ill. You don’t want to become ill. Some risk exists, but with a large group it is generally ok. Don’t install packages as root, don’t install what you don’t need.
I run my frontend builds through Docker (also during development). By isolating access to the host system to the files/folders necessary for development I’ve shielded off the majority of current realistic attacks I’ve seen as NPM based exploits. I’m certain the approach can be replicated for other frameworks, but we use Ember and docker-ember. I doubt it runs as smoothly on a non-Linux OS.
Can you provide a guide for how to use containers for that? I’m not familiar with them so I have no idea how to do that.
You could find out about the way we do it at https://github.com/madnificent/docker-ember but I would not if I were you.
The real risk, today at least, does not seem utterly huge. Jumping in this rabbit hole of containers is another topic in itself. I suggest continuing your learning as you do now and maybe revisit this later. You will learn faster that way.
Feel free to check what we did on the link above and ask questions later or whenever you feel ready for this topic.