{"id":103546,"date":"2022-03-15T15:37:46","date_gmt":"2022-03-15T13:37:46","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-rejtinga-bibliotek-trebuyushhih-osoboj-proverki-bezopasnosti"},"modified":"2022-03-15T15:37:46","modified_gmt":"2022-03-15T13:37:46","slug":"obnovlenie-rejtinga-bibliotek-trebuyushhih-osoboj-proverki-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/obnovlenie-rejtinga-bibliotek-trebuyushhih-osoboj-proverki-bezopasnosti","title":{"rendered":"Library rating update requiring special security checks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

The OpenSSF (Open Source Security Foundation), formed by the Linux Foundation and aimed at enhancing the security of open source software, has published a new edition of the Census II study, focused on identifying open projects that require priority security audits. The study targets the analysis of shared open code, implicitly used in various corporate projects as dependencies downloaded from external repositories. <\/p>\n

As a result, lists of the 500 most commonly used packages have been prepared, whose security and maintenance quality require special attention, as vulnerabilities and compromises of third-party component developers involved in application operations (supply chain) can undermine all efforts to improve the security of the core product. In total, 8 variations of lists are proposed, with content ranked according to various criteria, such as supply from the NPM repository and the availability of version information when determining dependencies. <\/p>\n

10 most commonly used JavaScript packages from the NPM repository, downloaded by applications without version binding: <\/p>\n