Show HN: Budibase – An open-source low code platform
Installing the budibase server from npm pulls in over a thousand transitive dependencies. The npm install command reports that there are 39 known vulnerabilities in budibase's dependencies, including 9 that are classed "high" and 3 that are "critical" severity.<p>The dependency graph includes a lot of crap, like packages containing trivial single-line functions like "is-object" and "is-stream". That's a very large attack surface considering the poor security practices in the npm ecosystem[0] and the growing frequency of attacks on transitive dependencies[1].<p>I'm interested in hearing from the creators what steps they take to audit their transitive dependencies in order to prevent this application from being compromised. Given that a tool like this would typically be given privileged access to internal data sources, it seems like a tempting target. I don't think I'd be comfortable using this in production.<p>[0]: <a href="https://www.bleepingcomputer.com/news/security/52-percent-of-all-javascript-npm-packages-could-have-been-hacked-via-weak-credentials/" rel="nofollow">https://www.bleepingcomputer.com/news/security/52-percent-of...</a> [1]: <a href="https://news.ycombinator.com/item?id=28962168" rel="nofollow">https://news.ycombinator.com/item?id=28962168</a>