Node.js · Senior · Question 31 of 75

Which measure helps most against malicious package versions (supply-chain attacks)?

1Using npx for every dependency
2Always installing the latest versions with npm update in production
✓Correct answer: A committed lock file with npm ci, careful updates, minimal dependencies and restricted install scripts

Explanation

Attackers publish compromised versions of popular packages. Delaying updates, reviewing diffs of new versions and npm provenance reduce the risk.

Further reading

Test yourself

Take the Node.js · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.