siddharthkp/auto-install

Does it protect against typosquatting?

renedekat opened this issue · 2 comments

renedekat commented

Will the --secure option protect against this: http://incolumitas.com/2016/06/08/typosquatting-package-managers/

siddharthkp commented

@renedekat, Yes, in --secure mode, as auto-install only attempts to install packages that have > 10k installs in the last month, it tries to ignore all the fake libraries.

I am using this as a proxy for trusted packages.

For example:
express has 6,820,817 downloads in the last month, while
expres has 728 downloads in the last month

The second one will be ignored by auto-install

Suggestions for making this better are welcome 😄

  • 👍25
siddharthkp commented

Added this to FAQ in README.md